Explain the circuit breaker pattern, and tell me when it does more harm than good.

A circuit breaker tracks failures to a dependency, opens once a threshold is crossed so calls fail fast instead of piling up, then half opens to test recovery with a trickle of traffic. It protects thread pools and connection pools from exhaustion and stops cascading failure. It hurts when thresholds are too tight, when the fallback is worse than the error, or when every instance opens at once and the dependency never gets enough traffic to prove it recovered.

Closed, open, half open. You count failures over a rolling window, and once you cross the threshold you open the circuit and fail immediately for a cool down period, then let a few probe requests through to see if the dependency is healthy again. The real point is protecting your own resources. If a downstream takes 30 seconds to time out, every worker thread ends up parked on it and your service dies of something that was not your fault. Where it goes wrong is scope and tuning. We had a breaker set at the service level rather than per dependency, so a flaky recommendations call opened the circuit for checkout too, which was a much bigger outage than the one we were preventing. The other trap is the half open trickle. If every replica opens simultaneously and probes rarely, the downstream sees almost no traffic and you stay dark far longer than the actual fault lasted.