ลำดับของตัวตกแต่งด้านความทนทาน

Resilience libraries let you wrap a call in multiple patterns at once: retry, circuit breaker, bulkhead, time limiter, rate limiter. The patterns form a chain, and order matters.

The same set of patterns produces different behavior depending on how they are nested.

Think of each pattern as a layer wrapping the next. The outermost layer sees the call first; the innermost actually invokes the dependency.

The recommended Resilience4j order puts Retry outside the Circuit Breaker.

This means each retry attempt is itself evaluated by the breaker. After enough failed attempts, the breaker opens and stops further retries entirely.

If Retry were inside the breaker, the breaker would only see one outcome per full retry cycle. A burst of internal retries could hammer a failing service before the breaker ever notices.

That is why retry usually wraps the breaker, not the other way around.

Place the Bulkhead inside the breaker so it limits concurrency on the actual calls. The breaker can then short-circuit before a thread is even acquired, keeping the bulkhead from filling with doomed calls.

The TimeLimiter sits close to the call so each individual attempt is bounded. A slow call times out, counts as a failure for the breaker, and can trigger a retry from the outer layer.

Put the RateLimiter on the outside if you want to cap total request rate including retries, or inside if you only want to cap actual dependency calls. Decide based on what you are protecting.

A widely used default, from outermost to innermost:

• Retry
• Circuit Breaker
• Rate Limiter
• Time Limiter
• Bulkhead

Adjust to your goals, but understand each move's effect.

The fallback should wrap everything so it can catch failures from any inner layer, including a retry that exhausted attempts or a breaker that is open.

Watch for surprising combos:

• Retry plus a rate limiter can amplify load if not bounded.
• A short time limiter inside aggressive retry can storm a slow service.
• Bulkhead rejections may count as breaker failures.

Because ordering effects are subtle, validate your chain with integration tests that inject failures and slowness, then assert the observed behavior matches your intent.

You learned why decorator order matters:

• Patterns nest as layers; outermost runs first.
• Retry outside the breaker lets the breaker stop retry storms.
• Bulkhead and time limiter sit close to the call.
• Fallback wraps everything.

Choose order by intent, then verify it with failure-injection tests.