I wrote:
For things like the PDF rendering where we need to be able to return data through the main web servers, isolation is still better -- we just need a timeout on fetches to make sure we don't get a million reqs stuck if the service hangs.
Funny story: the first prototype of our Lucene search server went live around Christmas 2004 and immediately hung the whole site thanks to an overloaded server and an incredibly long default timeout for HTTP fetches from PHP. :)
Ahh, those heady early cowboy days...
-- brion