Resilience is a system’s ability to recover gracefully from unexpected failures or pressure while continuing to provide acceptable behavior. It treats transient failures, dependency outages, traffic spikes, misuse, and attacks as conditions software must withstand rather than exceptions to normal operation. section 9.0 section 9.2
Design resilience along two complementary dimensions:
- Recover from failures with retries, circuit breakers, and fallbacks when dependencies become unresponsive. section 9.2
- Remain stable under load by regulating demand and containing pressure with rate limiters, backpressure, bulkheads, and time limiters. section 9.2
- Preserve useful behavior during partial outages with caches, watchdogs, and graceful degradation that prioritizes essential features. section 9.2
Contain a slow dependency
A slow payment service should not block product-catalog requests. A bulkhead isolates their connection pools, thread pools, or clients so payment pressure remains contained while the catalog continues functioning. A time limiter can release resources from payment operations that run too long. section 9.2
Figure 9.1 Layers of durability
Use the durability layers to place resilience within a broader design: implementation supports change, operability supports reliable behavior, testing protects evolution, and external contracts provide stability. section 9.0












