Scalability
Circuit Breaker
A resilience pattern that stops calling a failing dependency once errors cross a threshold — 'tripping open' to fail fast and give it room to recover, then probing with half-open trials before closing again. It stops one slow service from exhausting threads and cascading into total collapse. Pair it with sensible timeouts and fallbacks.
Purpose
A circuit breaker wraps calls to a dependency and watches the error rate: past a threshold it trips open and fails immediately without calling, giving the struggling service room to recover; after a cool-down it goes half-open, letting trial requests through, and closes again on success. It is the electrical breaker metaphor applied to RPC.
When to Use It
Any synchronous call to something that can go slow or down: payment gateways, third-party APIs, internal microservices. Its core job is stopping cascades — one slow dependency exhausting caller threads until the whole system stalls in sympathy.
Trade-offs
Thresholds need tuning: too sensitive and blips trip it needlessly; too lax and it never helps. It also needs an answer for the open state — a fallback, cached data, or an honest error — because failing fast is only a win if the caller handles the failure well.
Implementation
Use a library (resilience4j, Polly, Envoy's outlier detection) rather than hand-rolling. Combine with aggressive timeouts (a breaker cannot see hangs without them), a fallback path per dependency, and metrics on breaker state — a breaker stuck open is itself an incident signal.