Circuit Breaker Pattern: Microservices Resilience Guide (2026)

Q: What is the circuit breaker pattern in microservices?

The circuit breaker pattern monitors calls to a downstream service and automatically stops sending traffic to it when the failure rate exceeds a configured threshold, preventing the calling service from being dragged down by the failing downstream. It has three states: closed (normal operation, calls pass through), open (calls fail fast without contacting the downstream), and half-open (probing whether the downstream has recovered). The point of the pattern is to fail fast rather than fail slowly — when the downstream is broken, returning a circuit-open error in microseconds instead of waiting for a 30-second timeout prevents thread starvation in the caller and stops one failed service from cascading into a complete outage.

Q: When does a circuit breaker trip?

A circuit breaker trips from closed to open when the failure rate within its sliding window exceeds the configured threshold — typically 50 per cent failure rate over the last 20 to 100 calls, with a minimum number of calls (usually 20) before the threshold is evaluated. Modern circuit breakers also classify slow calls as failures: a call slower than 2 to 5 seconds counts toward the failure rate even if it returns successfully, because slow calls are the actual mechanism of cascading failures (they consume threads and exhaust connection pools). The breaker should count 5xx server errors and network exceptions, but ignore 4xx client errors which represent caller fault rather than downstream fault.

Q: What is the difference between circuit breaker, bulkhead, and retry?

These three patterns solve different but complementary problems. A circuit breaker stops calling a downstream that is failing, to prevent cascading failure. A bulkhead caps the number of concurrent calls to a downstream regardless of whether it is healthy or failing, isolating one downstream's slowness from monopolising the calling service's thread pool. A retry handles transient failures by attempting the call again with backoff. The complete resilience pipeline wraps a downstream call in (from outside in): bulkhead → circuit breaker → retry → timeout → actual call. Each pattern alone is insufficient; together they form the standard pattern for surviving downstream failures in production microservices.

Q: How long should the circuit breaker stay in the open state?

The standard wait duration in the open state is 30 to 60 seconds. Too short and the breaker re-tests the downstream before it has had time to recover, perpetuating the failure. Too long and the system continues to reject traffic after the downstream has actually recovered, degrading the user experience unnecessarily. Thirty seconds is a reasonable default for most services. Add jitter to the wait duration when running multiple service instances — without jitter, ten instances of the same service can simultaneously transition to half-open and flood the recovering downstream with trial traffic.

Q: What happens when a circuit breaker is open?

When a circuit breaker is open, calls to the wrapped downstream return a circuit-open exception immediately without contacting the downstream service — typically in microseconds rather than the seconds a real call would take. The calling code can then execute a fallback strategy: serve cached or stale data (gold standard for read paths), return static defaults (acceptable for low-stakes data like recommendations), queue the request for asynchronous retry (good for write paths to non-critical services), or fail the user request explicitly with a clear error (correct for payments, orders, or any operation where degradation is wrong). The choice of fallback depends on the business semantics of the call; the breaker provides the fast-fail trigger that makes any of these strategies feasible.

Q: What is half-open state in a circuit breaker?

Half-open is the probe state — after the wait duration in the open state has elapsed, the breaker allows a small number of trial calls (typically 5 to 10) through to test whether the downstream has recovered. If the trial calls succeed, the breaker transitions back to closed and resumes normal operation. If any trial call fails, the breaker returns to open and the wait duration restarts. The purpose is to test recovery without flooding a still-recovering downstream with full traffic. For flaky downstreams that succeed intermittently, configure the breaker to require multiple consecutive successes (not just any successes) before closing, to prevent oscillation between open and half-open.

Q: Should I use Resilience4j or a service mesh circuit breaker?

Use both — they solve different problems. Application-level circuit breakers (Resilience4j for Java, Polly for .NET, native libraries for other languages) handle service-level health: the entire downstream service is unhealthy, stop calling it for a while, and execute application-aware fallbacks (cache lookup, default value, queue for later). Service-mesh outlier detection (Istio, Linkerd) handles instance-level health: one of N pods of the downstream is broken, remove it from the load balancer pool. The mesh approach requires no code changes and works across language boundaries; the application approach has more context (can distinguish slow calls, can return application-aware fallbacks) but requires per-language libraries. Production systems typically run both in combination.

Q: Why do slow calls need to count as circuit breaker failures?

The most common cascading failure mode is not a downstream that returns errors, but a downstream that returns success slowly. A 10-second response that returns HTTP 200 is technically a success, but it consumes a thread for 10 seconds in the calling service. Enough of these and the calling service's thread pool exhausts, every call to the calling service starts timing out, and the cascade propagates upward. A breaker that only counts errors will not trip in this scenario because the downstream is "successful" — it just happens to be answering 100 times slower than normal. Modern breakers (Resilience4j onwards) classify slow calls — calls slower than a configured threshold like 2 seconds — as failures for the purposes of the breaker's failure rate, catching the silent cascades that pure error-rate breakers miss.

Q: When is the circuit breaker pattern not appropriate?

The circuit breaker pattern is not useful for: (1) calls within a single process, where the failure modes the breaker protects against (thread starvation, connection pool exhaustion, network instability) do not apply — reserve breakers for cross-process, cross-network calls; (2) calls where failure is deterministic rather than transient, such as a downstream that returns a constraint violation error — every retry will fail identically regardless of breaker state, so use input validation upstream instead; (3) cases where the calling code has no meaningful fallback and the entire user request fundamentally cannot complete without the downstream — the breaker still helps by failing fast, but the architectural answer is to reconsider the synchronous coupling and adopt asynchronous patterns (event-driven, queue-backed) that eliminate the synchronous dependency entirely.