Circuit Breaker Pattern in Production Java Services

A circuit breaker prevents a slow or failing downstream service from consuming all your application's threads and causing cascading failure. The name comes from the electrical analogy — when load is too high, the breaker trips and stops the flow.

Why it's necessary

• When a downstream service is slow (timeout of 30 seconds), every thread that calls it blocks for 30 seconds; at 200 concurrent users, your application exhausts its thread pool waiting for a service that's already failing — which means your service goes down because of another service's problem, even though your code is fine
• A circuit breaker fast-fails calls to the downstream service after a failure threshold is crossed, returning an error or a fallback immediately instead of waiting for the timeout

States — closed, open, half-open

• Closed: calls pass through normally; the circuit breaker counts failures in a sliding window; if the failure rate exceeds the threshold (e.g., 50% in the last 10 calls), the breaker opens
• Open: all calls fail immediately without reaching the downstream service; after a configured wait duration (e.g., 60 seconds), the breaker moves to half-open
• Half-open: a limited number of test calls are allowed through; if they succeed, the breaker closes and normal operation resumes; if they fail, the breaker opens again

Resilience4j in Spring Boot

• Add resilience4j-spring-boot3 (or v2 for Spring Boot 2); annotate the method with @CircuitBreaker(name = "paymentService", fallbackMethod = "paymentFallback")
• Configure in application.yml: failure rate threshold, slow call duration threshold, wait duration in open state, permitted calls in half-open state
• The fallback method receives the exception and can return a cached value, a default response, or throw a more descriptive exception

Combine with retry and timeout

• Circuit breaker + retry + timeout are the three components of a resilient HTTP client: timeout prevents indefinite blocking; retry handles transient failures; circuit breaker prevents retries from amplifying load on a failing service