ตัวตัดวงจรและการลดความสามารถอย่างราบรื่น

In a system of dependent services, one slow service can drag down everything that calls it. Threads pile up waiting, queues fill, and the failure cascades across the whole system.

High availability means containing failures, not just preventing them.

A circuit breaker wraps calls to a dependency. When failures cross a threshold, it opens and fails fast instead of waiting on a dead service.

• Stops wasting threads on doomed calls
• Gives the failing service time to recover

A circuit breaker has three states:

• Closed: calls flow normally, failures are counted
• Open: calls fail immediately without hitting the dependency
• Half-open: a few trial calls test whether the dependency recovered

Here is the core idea: count failures, trip when a threshold is reached, and refuse calls while open.

A breaker only helps if calls have timeouts. Without a timeout, a hung dependency holds a thread forever and failures are never counted. Always set aggressive, explicit timeouts on remote calls.

Retries can help with transient errors but can also amplify an overload. Use exponential backoff with jitter and cap the retry count. Combine with a circuit breaker so retries stop entirely when the circuit is open.

Graceful degradation means the system still does something useful when a dependency is down, instead of returning an error.

• Serve stale cached data
• Hide a non-critical feature
• Return a sensible default

When the breaker is open, route to a fallback. For a product page, if the recommendations service is down, show a generic best-sellers list instead of failing the whole page.

The bulkhead pattern isolates resources so one failing dependency cannot consume all threads or connections. Give each downstream dependency its own bounded pool — like watertight compartments in a ship.

Under extreme load, it is better to reject some requests quickly than to slow down for everyone. Load shedding drops low-priority traffic to protect critical paths and keep latency bounded.

Resilient services layer these patterns: tight timeouts, circuit breakers, bulkheads to isolate, fallbacks for degradation, and load shedding under pressure. Together they turn a potential outage into a minor, contained blip.

You learned to contain failures for high availability:

• Circuit breakers fail fast and cycle through closed, open, and half-open
• Timeouts and capped backoff retries prevent overload amplification
• Graceful degradation and fallbacks keep the system useful
• Bulkheads and load shedding isolate and protect critical paths