How is a circuit breaker different from just setting a timeout?

A timeout bounds one call; a breaker acts on the pattern across many calls. With only a timeout, every request still waits out the full timeout against a sick dependency and still adds load to it. Once a breaker trips, requests fail in microseconds without touching the network, freeing your threads and giving the dependency room to recover. You want both: the timeout detects individual slow calls, the breaker responds to the trend.

Where should the circuit breaker live, in my code or in the infrastructure?

Both layers exist and complement each other. In-process libraries like Resilience4j and Polly give you per-call-site breakers with application-aware fallbacks, like serving a cached response. Proxy-layer protection in Envoy or a service mesh caps connections and ejects failing hosts uniformly across all services regardless of language. Large systems typically run mesh-level protection as a floor plus in-process breakers where fallback logic needs business context.

What should happen to requests when the breaker is open?

That is a per-endpoint product decision. Options in rough order of preference: serve cached or stale data, return a static default, compute a degraded answer locally, queue the operation to complete later, or fail fast with a clear error. The one wrong answer is silently pretending the operation succeeded. And test the fallback path regularly, because a fallback that only runs during disasters tends to be broken by the time one arrives.

Architecturechapter 5 of 5 · 3 lessons

Circuit Breaker

Automatically stop calling a failing dependency to give it time to recover.

← All chapters View in cheatsheet

The most dangerous dependency in a distributed system is not the one that fails fast. It is the one that fails slowly, holding your threads hostage for thirty seconds at a time until your healthy service dies of somebody else's illness.

A circuit breaker notices that a dependency is sick and stops calling it, trading fresh answers for survival. The trade is the uncomfortable part, because you are choosing to fail requests you might have been able to serve, on the theory that failing a few now beats failing everything in ninety seconds.

Lessons

3 in this chapter

How Failures CascadeSlow dependencies eat threads, and eaten threads take healthy services down with them.2 min
Closed, Open, Half-OpenA per-dependency state machine that fails fast when sick and probes its way back to health.3 min
Tuning and FallbacksA breaker decides when to stop calling. The fallback decides what your users see instead.3 min