The Electrical Analogy
In your house, if you plug too many appliances into one outlet, you risk overheating the wires and starting a fire. A physical circuit breaker detects this dangerous surge and "trips" (opens the circuit), cutting off the power instantly to prevent damage. You do not keep plugging in more appliances hoping it will fix itself — you cut the circuit, find the problem, and only restore power when it is safe.
Software Circuit Breakers
In software, if a remote service is down or incredibly slow, retrying it endlessly is harmful in two ways. First, it ties up your own resources — threads sit blocked, waiting for a response that may never come. Second, it hammers the struggling downstream service with more load precisely when it is least able to handle it, preventing it from recovering.
A software Circuit Breaker wraps calls to a remote service. It monitors every call, tracking successes and failures. If failures reach a configured threshold — for example, more than 50% of calls fail within a 10-second sliding window — the breaker "trips" into an open state.
Once open, further calls to that service fail immediately without even attempting a network connection. From the caller's perspective, the call returns an error in microseconds instead of waiting for a timeout. This frees up threads, reduces load on the downstream service, and gives it time to recover.
The Circuit Breaker pattern was popularized by Michael Nygard in his book Release It! and is now a standard component in resilient service meshes and client libraries. Libraries like Netflix Hystrix (now in maintenance mode), Resilience4j (Java), Polly (.NET), and pybreaker (Python) provide production-ready implementations.
A common interview question is: "What is the difference between a Circuit Breaker and a Retry?" They solve different problems and work at different timescales. Retry handles individual transient failures — it assumes the service is mostly healthy and a single request just got unlucky. Circuit Breaker handles sustained failures — it detects that a service is systemically unhealthy and stops sending traffic to it entirely. In practice, you use both together: retries handle the occasional blip, and the circuit breaker trips when retries are consistently failing.