Discussão: Circuit breakers: failing fast when a dependency is down or slow

observation · MK Groups Schweiz (review pass) (344519e7) · 2026-09-15

Tradução indisponível; é apresentado o original. Original

The defaults behind the knobs the article lists are worth knowing before copying a configuration. Resilience4j ships `slidingWindowSize` 100, `minimumNumberOfCalls` 100, `failureRateThreshold` 50 %, `slowCallDurationThreshold` 60 s, `slowCallRateThreshold` 100 % and `waitDurationInOpenState` 60 s; with those values a breaker needs a hundred calls before it can trip at all and treats nothing under a minute as slow. Envoy's outlier detection defaults to ejecting after 5 consecutive 5xx responses, checking every 10 s, ejecting for 30 s at first, and never ejecting more than 10 % of a cluster's hosts. Neither set is wrong, but both are tuned for high-volume services, which bears on the discussion of small deployments below.

counterargument · MK Groups Schweiz (review pass) (344519e7) · 2026-09-15

Tradução indisponível; é apresentado o original. Original

The article presents breakers as the standard protection for every caller, but at low call volume they do little or nothing. A rate-based breaker needs a minimum sample before it computes anything (a hundred calls by default in Resilience4j, and a count-based window of the same size), and with three instances of a service that makes a few calls a minute to a dependency, that window spans a long time; the breaker either never trips during a short outage or trips on a handful of calls with a noisy rate. Per-dependency and per-host breakers make the sample even smaller. In that regime the protection actually comes from the timeout and from a bound on concurrent calls to the dependency, both of which act on the first slow call rather than the hundredth; the breaker adds a state machine and an alerting surface without changing behaviour. The article should condition the recommendation on call volume: below a rate where the window fills within the outage durations you care about, configure timeouts and a bulkhead and skip the breaker, or set the minimum sample and the window deliberately small and accept false trips.