Software ArchitectureAtlas

Software Architecture Atlas

Gain an overview. Understand the connections.

PatternChapter III · Operations · Building block 5 of 10

Bulkhead

A bulkhead isolates resources such as threads, connections, or worker pools. An overloaded function then primarily consumes its own quota.

By Michael Meierhoff · Meierhoff Systems

  1. QuotaOwn resource share per function.
  2. InsulationOverload remains in your own pool.
  3. Capacity planningQuota must fit the load.

Context

Why this is important

If all functions share the same threads or connections, a slow function draws the rest. Separate quotas limit the damage to one area. Backpressure and Breaker deepen their own building blocks.

This building block deals with resource isolation. Backpressure regulates the acceptance of new work; Circuit Breaker limits calls to disturbed dependencies.

At a glance · Separate compartments per dependency

Each dependency has its own limited pool; if one fails, the damage remains in the compartment.
Shop example · Playing through scenarios

Delayed bills in the worker pool

The modular shop uses a worker pool for invoices and its own pool for order confirmations. Delayed invoices do not prove the order confirmation capacity.

This is how you read the picture

  1. Quota In the case of ‘separate pools’, the capacity is separate as the invoice pool and the confirmation pool.
  2. Insulation Invoice orders are red, the confirmation of B-1042 It remains green.
  3. Capacity planning The confirmation pool remains free as long as its quota matches the load.
Invoicing PDF
Subdivision
  • runningInvoicing contractsis normal
  • runningConfirmation B-1042is processed immediately
  • runningWorker capacityEnough worker free

0Waiting confirmations

Both functions work with their capacity. The difference only shows up with delayed bills.

Delay the bills and change the pool allocation. You can see if the confirmation of B-1042 Must wait.

Benefits & limitations

Helps if:

  • Different response targets and resource profiles benefit from dedicated quotas under peak load.
  • Tenants or priority classes on a shared platform can be served fairly using bounded capacity shares.

Boundaries

  • Shared bottlenecks subvert the logical separation; check CPU, memory, pools, locks and network under simultaneous load.
  • Fixed reserves leave capacity unused; measure utilisation of the invoice pool and cap shared spare capacity.
  • Separation contains propagation but does not prevent failures within a pool; a Circuit Breaker adds protection against persistent failures.

In practice

  1. Locate the constrained resource. Record resource use per task class and identify the first pool to become exhausted. Trace isolation through to the database, CPU and network. This shows where quotas need to provide protection.
  2. Define quotas and queue limits. Set minimum and maximum capacity, maximum queued work and a priority rule. Decide whether new work waits or is rejected in a controlled way. This bounds utilisation and makes the response to exhaustion predictable.
  3. Measure and adjust isolation. Test response times, rejections and shared resources under simultaneous overload. Compare protection with unused reserves and adjust quotas using those measurements. This yields an empirically justified allocation reflecting the protection actually measured.
Read the detailed explanation

A bulkhead divides scarce resources into separate quotas by function, tenant or priority. Workers, connections, threads and queues can each have their own limits. Exhaustion initially remains confined to the affected class. This separation complements the state-based protection of a Circuit Breaker and flow control through Backpressure.

Isolation extends only as far as the actual shared bottlenecks. Separately started workers may still compete for the same CPU, database or network capacity. Quota size, queue limits and rejection behaviour therefore need to be designed together. Reserved capacity limits contention but may sit idle under uneven usage; measurements help balance protection and utilisation.

Check your understanding

Test yourself in three stages

  1. ReadingCheck in the picture

    If the confirmation of B-1042 Processed for delayed bills and separate pools?

    View the solution with justification

    Yes, immediately. The invoice pool is full, the confirmation pool remains free.

  2. ApplyingTransferred to a new situation

    Many slow invoice orders occupy the invoice pool. The customer orders B-1042. Is the order confirmation processed?

    View the solution with justification

    Yes, as far as the confirmation pool is appropriately dimensioned for the need. He has his own contingent, which the bills cannot consume.

  3. EvaluateWeighing an alternative

    The team uses a common pool instead of two separate ones. What speaks in favour, what speaks against?

    View the solution with justification

    For this: free capacity is available to all tasks, and there are fewer quotas to maintain. On the other hand: Slow bills can displace the confirmation. The bulkhead takes out this risk.

Explore further

These building blocks continue the thoughts of this page.

OperationsBackpressureBackpressure adapts message inflow to available processing capacity.Opening OperationsCircuit BreakerA Circuit Breaker pauses calls to a failing dependency and protects other workflows.Opening OperationsObservabilityObservability combines signals that let you inspect a system's internal state.Opening

References

Continue on the learning path

Next in Runtime & operations: Backpressure.

10 Building blocks

Continue withBackpressure