I wrote:
For things like the PDF rendering where we need to be
able to return
data through the main web servers, isolation is still better -- we just
need a timeout on fetches to make sure we don't get a million reqs stuck
if the service hangs.
Funny story: the first prototype of our Lucene search server went live
around Christmas 2004 and immediately hung the whole site thanks to an
overloaded server and an incredibly long default timeout for HTTP
fetches from PHP. :)
Ahh, those heady early cowboy days...
-- brion