Circuit Breaker
A circuit breaker stops calling a failing downstream service after a threshold of errors, preventing cascade failures. States: Closed (normal flow), Open (all calls fail-fast without attempting), Half-Open (limited test calls to check recovery). Prevents a slow/failing service from consuming all caller resources and propagating failure upstream.
Definition
The circuit breaker pattern (from Michael Nygard's Release It!) prevents cascading failures in distributed systems. When a downstream service fails repeatedly, the circuit breaker trips to Open state – subsequent calls return immediately with an error instead of waiting for timeout. This prevents: thread pool exhaustion (callers waiting on timeouts), timeout cascades (slow service makes callers slow, making their callers slow), and resource waste (retrying a service that is clearly down). After a configured reset timeout, the breaker moves to Half-Open – it allows a single test request through. If that succeeds, the breaker closes (normal flow resumes). If it fails, the breaker opens again. Configuration parameters: failure threshold (5 errors in 10 seconds), reset timeout (30 seconds), and half-open test count. Hystrix (Netflix, deprecated), Resilience4j (Java), Polly (.NET), and Envoy (built-in) implement circuit breakers.
Examples
- –Envoy: outlier_detection: { consecutive_5xx: 5, interval: 10s, base_ejection_time: 30s }
- –Resilience4j: CircuitBreaker.of('name', config).executeSupplier(() -> callService())
- –Istio DestinationRule: outlierDetection: { consecutive5xxErrors: 5, interval: 10s }
Related Protocols
Related Terms
Service Mesh
A service mesh is a dedicated infrastructure layer for service-to-service communication in microservices. Sidecar proxies (Envoy) handle mTLS, retries, circuit breaking, and observability transparently – without application code changes. Istio, Linkerd, and Consul Connect are the major implementations.
Rate Limiting
Rate limiting restricts the number of requests a client can make in a time window. Prevents abuse (brute force, scraping), protects backend resources, and ensures fair usage. Algorithms: fixed window, sliding window, token bucket, leaky bucket. Return HTTP 429 Too Many Requests with Retry-After header when limits are exceeded.
Graceful Degradation
Graceful degradation allows a system to continue operating with reduced functionality when components fail, rather than failing completely. A site with a failed recommendation engine still shows products. A service with a failed cache still queries the database (slower but functional). Requires identifying which features are optional.