Budget NGINX Proxy Sockets Before Raising worker_connections
A proxied connection commonly uses both a client and an upstream socket; distinguish the worker connection limit from the service's file-descriptor limit.
One long-lived proxied connection commonly occupies two sockets: the client's and the upstream's. worker_connections counts both sides. Multiplying it by worker_processes therefore does not give a proxy-user capacity promise.
When connections fail, follow the reported limit:
| Evidence | Setting or process state to inspect |
|---|---|
| worker_connections exhaustion | The worker connection budget, including upstream sockets |
| Operating-system “Too many open files” | The file-descriptor limit inherited by the actual service process |
Listening sockets, logs and other open files also consume descriptors. Connection reuse and the traffic mix change the relationship between users and sockets.
worker_rlimit_nofile adjusts worker limits subject to the environment's permissions. A systemd unit can set LimitNOFILE; an interactive shell's ulimit does not change the running service.
Size the limits for the workload, and inspect who consumes them. Unexpected clients or repeatedly failing upstream connections can exhaust a previously adequate budget. A larger process-count or memory limit does not repair a descriptor shortage.