Retry Budgets Don't Stop Retry Storms. Uber's Error Ownership Protocol Does

Sat, 19 Sep 2026 09:00:00 +0530

Retry budgets are the standard answer to retry storms: cap retries at each hop to some percentage of traffic, and the theory is that a struggling downstream service never gets hit with more than a bounded multiple of its normal load. Uber’s engineering team published the math showing why that theory is wrong for any call chain with real depth, and shipped a fix that’s been running across their service mesh: a header-based protocol that tells each service whether an error it’s looking at is actually its own to retry, or someone else’s.

Reliability on Kuldeep Pisda

Retry Budgets Don't Stop Retry Storms. Uber's Error Ownership Protocol Does