Isolate failures so one slow downstream cannot exhaust shared resources.

Data Flow

                  [ API gateway ]
                          |
        +-----------------+-----------------+
        v                 v                 v
  [pool: Search]   [pool: Reviews]   [pool: Recs]
        |                 |                 |
        v                 v                 v
     SearchService   ReviewsService   RecsService

If RecsService hangs, only the Recs pool exhausts. Search and Reviews keep serving traffic.

When to use

• Multi-tenant workloads (one tenant’s burst shouldn’t affect others).
• Failure isolation between independent downstream dependencies.

Pitfalls

• Under-sizing a bulkhead: legitimately healthy traffic gets rejected because the pool is too small.
• No overflow path: under-sized bulkheads must spill to a fallback (cached response, default value).

Analogy

Watertight compartments in a ship — one leak does not sink the whole vessel.

Interview tip: State the resource (thread pool, connection pool) and how the overflow is handled.