Circuit Breaker
Stop spending resources on a dependency that is persistently failing.
Problem
Timeouts cascade through callers and exhaust pools.
When to use it
- Remote calls fail independently
- A fallback or explicit unavailable response exists
When not to use it
- Local database constraints
- A breaker would mask correctness-required work
Minimal example
Open after a rolling failure threshold, reject briefly, then allow limited half-open probes.
Tradeoffs
- Thresholds can flap
- It complements—not replaces—timeouts and bulkheads