Problem
A single misbehaving downstream service consumes all caller resources (thread pool, connection pool), causing total outage.
resilienceestablished · medium operational burden
Bulkhead
Also known as: bulkhead-pattern, resource-isolation
Intent
Isolate critical resources (threads, connections, memory) so failure in one component doesn't starve others.
Forces
- •Shared resource pools create single point of contention
- •Different downstreams have different criticality
- •Resource exhaustion cascades across unrelated operations
- •Need to prioritize critical paths during degradation
Solution
✓ When to Use
- •Caller has multiple downstreams with different SLAs
- •Critical path must stay responsive during non-critical downstream issues
- •Prevent noisy neighbor problem in shared infrastructure
✗ When Not to Use
- •Single downstream (circuit breaker sufficient)
- •Very low throughput where isolation overhead exceeds benefit
- •When resource pooling is required for efficiency (e.g., DB connections)
Pros
- +Strong isolation — failure contained to one bulkhead
- +Enables priority-based resource allocation
- +Observable: per-bulkhead metrics reveal bottlenecks
Cons
- −Reduces resource efficiency (unused capacity in idle bulkheads)
- −Complexity: sizing, monitoring, tuning per bulkhead
- −Can cause false resource exhaustion if sized too small
Cost Profile
Infrastructure
Low — configuration, no new infrastructure
Operational
Medium — monitor per-bulkhead saturation
Cognitive
Medium — capacity planning per dependency
Failure Modes
Bulkhead too small → false rejections under normal load
Bulkhead too large → no isolation benefit
Cascading rejection: bulkhead rejects → caller retries → upstream bulkhead saturates
Real-World Examples
Alternatives
- circuit-breaker
- rate-limiting
- priority-queue
Related Patterns
- circuit-breaker
- rate-limiting
- retry-with-backoff
Competency Domains
reliability opsdistribution communicationeconomics evolution