sing-box — Config Layout

sing-box reads a single JSON document at startup. The root object maps to Go struct _Options at option/options.go:12 (exported as Options via a type alias whose UnmarshalJSONContext enforces strict unknown-field checking — typos in your config produce a startup error, not silent ignoring).

Root keys

Key	Go field	Type	Page	Description
$schema	Schema	string	(none)	JSON-schema URL; ignored at runtime.
log	Log	*LogOptions	Log	Severity, output, timestamp, disable toggle.
dns	DNS	*DNSOptions	DNS — Phase 5	DNS servers, rules, hosts, fakeip.
ntp	NTP	*NTPOptions	NTP	Optional embedded NTP client.
certificate	Certificate	*CertificateOptions	Certificate	Root-CA bundle source for TLS verification.
endpoints	Endpoints	[]Endpoint	Endpoints — Phase 3	Endpoint inbound/outbound (WireGuard, Tailscale).
inbounds	Inbounds	[]Inbound	Inbounds — Phase 3	List of listening services.
outbounds	Outbounds	[]Outbound	Outbounds — Phase 3	List of upstream targets.
route	Route	*RouteOptions	Route — Phase 5	Routing rules, rule-set, default outbound.
services	Services	[]Service	Services — Phase 6	Background services (resolved, derp, ssm-api).
experimental	Experimental	*ExperimentalOptions	Experimental	Cache file, Clash API, V2Ray API, pprof debug.

Pages marked Phase 3/5/6 ship in those later phases; the column is here so the layout is complete today.

At a glance

{
  "log": { "level": "info", "timestamp": true },
  "dns": { "servers": [{ "tag": "google", "address": "tls://8.8.8.8" }] },
  "ntp": { "enabled": true, "server": "time.cloudflare.com" },
  "certificate": { "store": "system" },
  "inbounds": [],
  "outbounds": [],
  "route": { "final": "direct" },
  "experimental": {
    "cache_file": { "enabled": true },
    "clash_api": { "external_controller": "127.0.0.1:9090" }
  }
}

Source: option/options.go:12-25 · v1.13.11 (553cfa1)