What happened when we ran it
Our sandbox installed 411 Go packages in 104 seconds, then built commit 712046a successfully in 107 seconds. The checkout was 91 MB, with 2,915 files and about 450,280 source lines, so this is a substantial networking core rather than a small command wrapper.
Tests took another 52 seconds and failed: 15 of 18 test groups passed, while 3 failed. The end of the captured log listed transport packages that had no test files and then printed FAIL. It did not show the failing assertions or a cause, so the finding is limited to the result: our clean Go 1.24 run did not produce a fully passing suite.
One process owns proxying, DNS, and routes
sing-box accepts traffic through TUN, SOCKS, HTTP, Shadowsocks, Trojan, VMess, VLESS, Hysteria, TUIC, AnyTLS, and other inbound types. It can send that traffic through direct connections, proxies, SSH, Tor, WireGuard, OpenVPN, Tailscale, and related outbounds or endpoints. DNS resolution and route selection live in the same configuration.
A router or desktop that once needed a DNS forwarder, transparent proxy, and protocol-specific client can express that chain in one process. sing-box also runs server listeners, so the core works on both ends. It does not supply a remote network: operators bring servers, credentials, certificates, routes, and policy.
Packages are easy; correct TUN policy is not
SagerNet documents APT and DNF repositories, a Linux and OpenWrt installer, packages for major desktop systems, GitHub releases, and a container image. Linux packages can include a systemd service.
After installation, sing-box expects JSON. A top-level file can define logging, DNS, NTP, certificate providers, HTTP clients, network namespaces, endpoints, inbounds, outbounds, routes, services, and experimental APIs. The supplied JSON Schema helps editors catch shape errors, while sing-box check validates configuration, format normalizes it, and merge combines files or configuration directories. These are useful tools because realistic configurations grow quickly.
A minimal local SOCKS proxy is not hard. A dependable whole-device TUN setup is. The operator must understand which traffic enters the tunnel, how the program's own connections escape it, which DNS server resolves each class of name, whether FakeIP is acceptable, how IPv4 and IPv6 differ, and which process or domain rules win. On a server, add user authentication, TLS certificates, firewall policy, and log handling.
The breadth is genuinely useful
Protocol range alone can become checkbox collecting, but sing-box integrates its pieces into a coherent routing model. Route rules can consider domains, networks, ports, protocols, source attributes, processes, users, packages, and remote rule sets. DNS has its own rules and server types, rather than being an afterthought sent outside the tunnel. Selector and URLTest outbounds provide manual or latency-based path choice.
The newer endpoint model brings network-style connections such as WireGuard, Tailscale, OpenVPN, and OpenConnect into the configuration. Certificate providers, network namespaces, and services further widen what one process can own. Optional Clash and V2Ray APIs help existing dashboards and monitoring tools fit around it. Official graphical clients on Android, Apple platforms, and desktop systems define profiles, imports, status views, traffic, and selector controls around the same core.
That integration is the advantage over a narrow Shadowsocks implementation. One protocol favors a smaller daemon; policy routing, split DNS, and several transports make consolidation useful.
Configuration churn is part of the deal
sing-box develops quickly and is willing to remove old configuration concepts. The 1.14 migration guide moves inline ACME settings into certificate providers, changes address-based DNS filtering to explicit response matching, removes an independent cache option, replaces cache fields, and continues earlier DNS server and rule-action migrations. Some legacy combinations are rejected at startup.
This is responsible when old abstractions block a cleaner design, but it creates work for operators. Do not point an unattended package updater at a critical gateway and hope old JSON remains valid. Pin a stable release, read the migration page before crossing minor versions, run sing-box check against the new binary, and keep the previous package and configuration ready for rollback.
Current bugs reinforce that advice. Issue 4392 describes a regression in stable versions 1.13.15 and 1.13.16 where a qBittorrent NAT-PMP request on Linux produces high-rate TUN traffic; the reporter says 1.13.14 is unaffected. Issue 4178 reports a possible Windows IPv6 self-route loop under a 1.14 alpha build. These are specific network interactions, not proof the core is generally unreliable, but a proxy failure can disrupt all traffic on a machine.
A newer report, issue 4446, describes thread counts climbing until sing-box 1.13.19 aborts on one Windows 11 TUN setup. Issue 4450 reports that the 1.14.0 release candidate fails to link when cross-compiled with Go 1.27, while the reporter says Go 1.26 works. Both reports are narrow, but both warrant testing the exact platform and toolchain intended for deployment.
The August 2026 release stream is active
The repository README is unusually thin, but the linked documentation site is extensive and available in English and Chinese. It has field-level configuration references, installation pages, client behavior, examples, migration instructions, and a long changelog. The weakness is discoverability for beginners: the documentation explains every component better than it teaches a newcomer how to design a safe routing policy.
The last push was August 25, 2026, and release 1.13.19 arrived on August 17. GitHub listed 288 open issues and pull requests, with reports still updated on August 26. More than 37,000 stars show reach, while the push and issue dates show current maintenance. The release pace also creates upgrade work.
sing-box is an excellent choice for an expert who wants a modern, cross-platform networking core and will treat configuration as infrastructure. It is a poor choice for someone who wants one server address, one connect button, and no routing homework. Start with the smallest configuration that works, add rules only when their purpose is testable, and never upgrade a gateway without checking the migration notes and exercising DNS, IPv6, UDP, and TUN traffic.