Bulkhead

Named for a ship's compartments: a breach floods one section rather than sinking the vessel.

The most common and most valuable application is a separate connection or thread pool per downstream dependency. Without it, one slow dependency holds every connection in a shared pool, and the service stops serving requests that do not touch that dependency at all — which is how a single slow service takes down four that do not depend on it.

Other applications: per-tenant quotas so one customer cannot consume the whole worker pool, and separate instance groups for critical and non-critical traffic.

It is a more fundamental control than a circuit breaker and frequently missing where breakers are present. A breaker limits damage after failure is detected; a bulkhead stops the failure spreading in the first place, including during the seconds before detection.