Resilience and fault isolation

Prevents cascading failures by partitioning shared resources into isolated pools that fail independently.

Microservices: isolating thread pools per downstream dependency so one slow service cannot starve others; Cloud architecture: partitioning service instances into failure domains so a regional outage cannot consume global capacity; Distributed systems: separating connection pools per external API to cap blast radius of a misbehaving integration

Microservices architecture, cloud-native systems (AWS, Azure, GCP), resilience engineering, circuit breaker libraries (Resilience4j, Hystrix, Polly), service mesh implementations

partition resource pool → assign compartment per dependency → isolate failures → degrade independently

• circuit breaker
• timeout
• retry
• thread pool isolation
• connection pool
• semaphore
• rate limiter
• fallback
• service mesh

• Shared thread pool with circuit breaker (simpler but allows resource starvation)
• Process-level isolation via containers (stronger isolation but higher overhead)
• Semaphore-based bulkhead (lighter weight than separate pools but coarser control)

Applying bulkhead to every dependency equally (causes resource fragmentation and underutilization); Using bulkhead without timeouts (slow requests still consume compartment capacity); Confusing bulkhead with circuit breaker (bulkhead isolates resources, circuit breaker stops calls — they complement each other); Setting compartment sizes too small (legitimate traffic gets rejected during normal spikes); Forgetting to monitor per-compartment saturation (defeats isolation if one pool silently fills)

Circuit breaker (stops calls when failure rate is high vs. bulkhead caps resource usage regardless of failure rate); Sandbox (isolates execution environment vs. bulkhead isolates resource pools); Cell-based architecture (geographic/blast-radius isolation at deployment level vs. bulkhead at resource level); Rate limiter (throttles call rate vs. bulkhead caps concurrent resource consumption)

Coming from Java Hystrix: may conflate bulkhead with circuit breaker since Hystrix bundles both — they are orthogonal concerns; Coming from monolithic Java EE: may default to a single shared thread pool — bulkhead requires deliberate per-dependency pool sizing

• circuit breaker
• timeout
• retry
• fallback
• rate limiter
• cell-based architecture

When NOT to use: skip bulkhead when dependencies are uniformly reliable and resource budgets are tight — the overhead of multiple pools wastes memory. Performance: each compartment has its own queue and worker threads, so total thread count grows with compartment count; underprovisioned compartments cause artificial rejections. Boundary conditions: bulkhead does not prevent failures, only limits blast radius — pair with circuit breaker and timeout for full resilience.

Prevents one misbehaving dependency from triggering total service outage, enabling graceful degradation where non-critical features fail while core functionality remains available.

Bulkhead pattern: like watertight compartments in a ship — one hull breach sinks only that section, not the whole vessel.

Cell-based architecture with bulkhead-aware deployment topology and per-cell autoscaling