Nginx Worker Tuning Calculator
Size Nginx worker processes and connections from cores and traffic, calculate the file descriptor limit a proxy actually needs, and generate the tuned configuration.
Last reviewed by the Radiatus Cloud team
Want this automated for your stack?
We build CI/CD, Kubernetes & IaC pipelines that scale.
Workers should match cores, connections should not
Nginx uses an event driven model where a single worker handles thousands of connections concurrently, so more workers than cores adds context switching without adding capacity. The setting people get wrong is worker_connections, which defaults to 512 or 1024 and caps total capacity at that number multiplied by the worker count. A server with four workers and the default is limited to about four thousand connections regardless of how much memory it has, and the failure mode is a worker_connections exhaustion message in the error log that nobody reads until traffic drops.
A proxy uses two descriptors per request
When Nginx serves static files, one connection costs roughly one file descriptor. When it proxies, each client connection has a matching upstream connection, so the arithmetic doubles, and any additional upstream in the request path doubles it again. The worker_rlimit_nofile setting must account for that, and it must be below the process limit set by systemd or the container runtime, which is a separate ceiling that silently caps the whole thing.
Keepalive to upstreams is the setting most often missing
Without an upstream keepalive block, Nginx opens a new TCP connection to the backend for every proxied request, which adds a handshake to each one and burns through ephemeral ports under load. Adding a keepalive directive with proxy_http_version 1.1 and an emptied Connection header reuses connections and typically removes a measurable slice of latency. It is three lines and it is absent from a large proportion of production configurations.
Related tools
- CI/CD Security Gap Analyzer — Checklist based analyzer for CI/CD pipeline security gaps.
- Docker Security Scanner — A new tool extracted from the codebase.
- Terraform Scanner — A new tool extracted from the codebase.
- SQL Formatter — Format and indent SQL queries for readability. Handles joins, subqueries and CTEs, supports common dialects, and runs entirely in your browser.
Frequently Asked Questions
How many worker processes should I run?
worker_processes auto, which matches the core count. Nginx workers are event driven and each handles thousands of connections, so exceeding the core count adds context switching without capacity. In a container, auto reads the host cores, so set it explicitly to the CPU limit.
What should worker_connections be?
High enough that worker_processes times worker_connections comfortably exceeds peak concurrency, commonly 4096 to 16384. The default of 512 or 1024 caps a four worker server at a few thousand connections regardless of available memory.
Why does my file descriptor limit matter?
Each connection consumes at least one descriptor, and a proxied request consumes two because there is a client connection and an upstream one. worker_rlimit_nofile must cover that, and it must also be below the process limit imposed by systemd or the container, which is a separate ceiling.
What does upstream keepalive do?
It reuses TCP connections to the backend instead of opening a new one per request. Without it, every proxied request pays a handshake and the server burns ephemeral ports under load. It requires proxy_http_version 1.1 and clearing the Connection header to work at all.
Should I enable sendfile and tcp_nopush?
Yes for static content: sendfile copies file data in the kernel without passing through user space, and tcp_nopush batches the response headers with the start of the body into one packet. Neither helps for proxied dynamic responses, where the data comes from a socket rather than a file.
Privacy & Security
Everything runs in your browser; nothing is uploaded.
How to Use
Enter cores, expected concurrent connections and role to get worker settings and limits.
Disclaimer: This tool is provided "as is" without warranty of any kind. Results are for educational and utility purposes.