Every process starts with 0 (stdin), 1 (stdout) and 2 (stderr). Each additional open file and each network connection takes another descriptor, so a web server or proxy with many concurrent connections needs many of them.
The per-process limit is often 1024. When it is reached, new connections fail with Too many open files. For services under systemd the shell's ulimit does not apply; LimitNOFILE= in the unit does.
If a process's open descriptor count keeps rising, suspect a leak. Deleted log files that are still open also keep using disk space; lsof +L1 finds them.
Example
ls /proc/$(pgrep -o nginx)/fd | wc -l