A team proposes circuit breakers on every downstream call. What would you add, and why is the breaker not the most important control?
Show the full answer Hide the answer
Why the bulkhead matters more
A circuit breaker acts after it has detected a pattern of failure. During the seconds before it trips — and while its threshold is being evaluated — calls are still being made, still holding threads, and still consuming a shared pool.
A bulkhead prevents the spread structurally: each dependency gets its own pool, so a slow one can only ever exhaust its own allocation. Requests that do not touch it are unaffected regardless of whether any breaker has noticed yet.
Put differently: the breaker limits the duration of the damage; the bulkhead limits its scope. Scope is the more valuable thing to bound, and it holds during the detection window when the breaker is still deciding.
The second thing to add: fallbacks
A breaker that converts slow errors into fast errors has changed the shape of the outage without preventing it. What you fail fast to is where the value is — stale cache, a default, a degraded feature, a queued write, or an explicit and honest error.
This should be decided per dependency, in advance, and written down. The alternative is deciding during an incident, and the answer then is always 500.
Why the other options are weaker
More aggressive thresholds trade one problem for another — the breaker trips on transient noise, and the fallback path becomes the common path.
Retries with backoff are necessary but orthogonal, and without a retry budget they amplify load during exactly the failure the breaker exists for.
A service mesh is a delivery mechanism for breakers, not an improvement to the pattern. It gives uniform policy across a polyglot estate and cannot supply application-aware fallbacks, because the proxy does not know your domain.
What a strong answer adds
Naming the ordering: bulkhead → timeout → breaker → fallback. Isolation first, then bound the wait, then stop calling, then serve something useful. Teams usually start at step three.