รูปแบบ Bulkhead

The name comes from ships: a hull is divided into watertight bulkhead compartments. If one floods, the others stay dry and the ship survives.

In software, the bulkhead pattern isolates resources so a failure in one area cannot sink the entire system.

Imagine one slow downstream service. If all requests share a single thread pool, requests to the slow service consume every thread. Soon healthy services cannot get a thread either. One failure cascades into total outage.

The fix: give each dependency its own pool of resources (threads or connections). When the slow service exhausts its pool, only calls to that service degrade.

The classic implementation assigns a dedicated thread pool per dependency. Calls run on that pool, so saturation is contained to one dependency.

Libraries like Resilience4j and the historical Hystrix offer this out of the box.

A lighter approach uses a semaphore that limits concurrent calls without a separate thread pool. It has less overhead but cannot enforce timeouts on the caller's thread.

When a bulkhead is full, the call is rejected immediately instead of queuing forever. Fast rejection lets the caller fall back gracefully and keeps the system responsive.

Pool size is a trade-off. Too small wastes capacity; too large defeats isolation. A common starting point is based on expected concurrency: poolSize = peakRPS * avgLatencySeconds plus a small buffer.

They complement each other:

• Bulkhead limits how many calls run at once (resource isolation).
• Circuit breaker stops calling a failing service entirely.

Use both: the bulkhead contains the blast radius, the breaker stops the bleeding.

In multi-tenant systems, isolate resources per tenant so one noisy customer cannot starve others. This is sometimes called the noisy neighbor defense.

Track pool utilization and rejection counts. A consistently saturated bulkhead means either the dependency is unhealthy or the pool is undersized. Alerts on rejection rate catch problems early.

Apply bulkheads whenever a single component calls multiple independent dependencies, especially when some are slow or unreliable. It is one of the simplest, highest-value resilience patterns.

What is the primary benefit of the bulkhead pattern?

You learned the bulkhead pattern:

• Isolate resources per dependency, like ship compartments.
• Use thread-pool or semaphore bulkheads.
• Reject excess load fast and size pools deliberately.
• Combine with circuit breakers for layered resilience.

Bulkheads keep one failure from sinking the whole ship.