Usage of /usr/bin/sandbox-router:
  -access-log
    	Emit one structured log line per inbound request on the proxy port. Health/metrics endpoints are skipped. (default true)
  -allow-loopback-pod-ip
    	Allow X-Sandbox-Pod-IP to carry a loopback address (127.0.0.0/8 or ::1). Default false (loopback rejected with 400). Enable for sidecar deployments where the sandbox shares a Pod with the router, or for integration tests using a localhost backend. Link-local, multicast, and unspecified addresses stay rejected regardless of this flag.
  -authz-cookie-allowed-origins value
    	Comma-separated allowlist of scheme://host[:port] Origins permitted to make a cookie-authenticated request authorized by --authz-cookie-name — any request, not just protocol upgrades, though a WebSocket handshake is the case this exists for. Same-origin requests are always allowed regardless of this list; a request with no Origin header is let through here since there is nothing for this check to inspect. Only checked when the credential that authorized the request came from the cookie — a header- or query-sourced credential cannot be forged by a third-party page and is not subject to this check.
  -authz-cookie-insecure
    	Omit the Secure attribute from the bootstrapped cookie. Only for local development over plain HTTP. Incompatible with --authz-cookie-samesite=none.
  -authz-cookie-name string
    	Name of a cookie the configured Authorizer additionally accepts a credential from — the only channel a browser attaches automatically to every request toward an origin, including a WebSocket handshake. Off by default. Requires --path-routing-prefix and an --authz-mode other than allow-all. See --authz-cookie-query-param for how the cookie gets set in the first place.
  -authz-cookie-query-param string
    	Name of a URL query parameter that bootstraps --authz-cookie-name: a GET/HEAD, non-upgrade request presenting a valid credential here gets the cookie set — scoped by Path to exactly the sandbox it authorized — and is redirected (302) to the same URL with the parameter stripped, so the credential spends the least possible time exposed in the URL, browser history, and Referer. Requires --authz-cookie-name.
  -authz-cookie-samesite string
    	SameSite attribute of the bootstrapped cookie: lax (default; covers same-site embedding without requiring HTTPS), strict (never sent cross-site, including the navigation that bootstraps it — rarely what you want here), or none (for genuinely cross-site embedding; requires the cookie to be Secure, and some browsers block it as third-party regardless). (default "lax")
  -authz-mode string
    	Per-request authorization strategy: allow-all (default, no auth), tokenreview (validate Bearer tokens via the K8s TokenReview API), or scoped-token (validate a per-sandbox signed token minted out-of-band; see --authz-scoped-token-secret-file). tokenreview requires either in-cluster config or --kubeconfig. (default "allow-all")
  -authz-scoped-token-secret-file string
    	Path to a file holding the shared HMAC-SHA256 secret used to verify legacy v1 scoped tokens (see authz.MintScopedToken). Required when --authz-mode=scoped-token unless v2 verification keys are configured.
  -authz-scoped-token-v1-accept-until string
    	Exclusive RFC3339 cutoff for legacy v1 HMAC verification during a v2 rollout. Required when v1 and v2 verification are both configured.
  -authz-scoped-token-verification-keys-file string
    	Path to a JSON key set containing Ed25519 public keys for scoped-token v2 verification. Enables v2 and requires --cache-enabled.
  -authz-tokenreview-audiences value
    	Comma-separated audience values to verify against the token's aud claim. Empty disables the audience check. Required when authenticating projected ServiceAccount tokens minted with --audience.
  -authz-tokenreview-cache-size int
    	Maximum number of cached TokenReview decisions before LRU eviction. (default 2048)
  -authz-tokenreview-require-token
    	When true, reject requests that arrive without an Authorization: Bearer header with 401. When false (default), tokenless requests are allowed — useful during client rollouts.
  -authz-tokenreview-ttl duration
    	How long a TokenReview decision is cached. Shorter values catch token revocations sooner at the cost of more apiserver load. (default 30s)
  -authz-trust-forwarded-proto
    	Read the scheme for the same-origin half of the cookie-authz check from the first value of X-Forwarded-Proto, when present, instead of r.TLS != nil. Off by default. Needed behind any TLS-terminating load balancer or Gateway — the common production shape — where r.TLS is always nil and every same-origin request would otherwise be misjudged cross-origin. Only enable this when the router is reachable exclusively through a proxy that sets this header itself and strips any client-supplied one first; otherwise a client with direct network access to the router could forge its own scheme. Has no effect without --authz-cookie-name.
  -cache-enabled
    	Enable the in-process Pod-IP cache (KEP-NNNN fast path). When on, the router watches sandbox-owned Pods and dials cached IPs for requests carrying X-Sandbox-UID, bypassing DNS. Requires Pod get/list/watch RBAC and either in-cluster config or --kubeconfig.
  -cache-namespace string
    	Optional namespace filter for the Pod informer. Empty means cluster-wide. Ignored when --cache-enabled=false.
  -cluster-domain string
    	Kubernetes cluster DNS suffix used to build sandbox FQDNs. Honors CLUSTER_DOMAIN. (default "cluster.local")
  -config string
    	Path to a YAML config file with keys matching flag names (kebab-case). Also honors SANDBOX_ROUTER_CONFIG. File values override env-var defaults; CLI flags override file values.
  -enable-otel-metrics
    	Additionally push metrics via OTLP gRPC. The Prometheus /metrics endpoint remains active. Endpoint is taken from OTEL_EXPORTER_OTLP_ENDPOINT (or OTEL_EXPORTER_OTLP_METRICS_ENDPOINT). Auto-enabled when either env var is set; pass --enable-otel-metrics=false to override.
  -enable-tracing
    	Enable OpenTelemetry tracing via OTLP. Endpoint is taken from OTEL_EXPORTER_OTLP_ENDPOINT (or OTEL_EXPORTER_OTLP_TRACES_ENDPOINT). Auto-enabled when either env var is set; pass --enable-tracing=false to override.
  -grpc-proxy-timeout duration
    	Optional total gRPC duration cap, including authorization. 0 means no router cap; caller deadlines still apply.
  -grpc-web-allowed-origins value
    	Comma-separated allowlist of scheme://host[:port] browser origins permitted to call the router with gRPC-Web (Content-Type application/grpc-web). Listed origins get CORS response headers (same-origin requests are always allowed those too) and their CORS preflights are answered by the router; every other OPTIONS request is proxied unchanged. When empty (the default), cross-origin browser callers get no CORS headers and the browser blocks the response; non-browser clients are unaffected either way. This list gates only gRPC-Web traffic — plain HTTP CORS behavior is unchanged.
  -health-probe-bind-address string
    	Address for the /healthz and /readyz endpoints. (default ":8081")
  -http-bind-address string
    	Address for the plain-HTTP proxy listener (set empty to disable). (default ":8080")
  -https-bind-address string
    	Address for the TLS proxy listener (empty disables TLS).
  -kubeconfig string
    	Paths to a kubeconfig. Only required if out-of-cluster.
  -max-request-body-bytes int
    	Optional cap on inbound request body size in bytes. 0 means unlimited.
  -metrics-bind-address string
    	Address for the Prometheus /metrics endpoint. (default ":9090")
  -metrics-secure-serving
    	Serve the /metrics endpoint over TLS using the same certificate as the HTTPS proxy listener. Requires --tls-cert-file and --tls-key-file.
  -mtls-mode string
    	Client-cert verification policy: off, optional, or required. (default "off")
  -path-routing-prefix string
    	Optional URL path prefix that additionally lets a caller address a sandbox via <prefix>/<namespace>/<id>/<port>/<rest...>, instead of X-Sandbox-* headers. Off by default (headers only, unchanged). Enable this for browser-facing traffic: a WebSocket handshake has no API for custom headers, so a browser can only reach a WebSocket-dependent backend inside a sandbox (a web IDE's terminal, a dev server's HMR socket) through this router via a path it can put in a plain URL. A request whose path does not match this prefix falls straight through to header-based routing — but this claims the whole URL namespace under the prefix: once a path DOES match, it stays on the path-routing path even if it's otherwise malformed (bad namespace/id/port), and is never retried against headers. Pick a prefix no real in-sandbox route needs to answer under.
  -proxy-timeout duration
    	Total time budget for proxying a normal HTTP request (not gRPC) to a sandbox. Honors PROXY_TIMEOUT_SECONDS (numeric seconds). (default 3m0s)
  -response-header-timeout duration
    	Maximum time to wait for HTTP upstream response headers (not gRPC). (default 30s)
  -shutdown-timeout duration
    	Time budget for draining in-flight requests on SIGTERM. (default 30s)
  -tls-cert-file string
    	Path to the PEM-encoded server certificate.
  -tls-cipher-suites value
    	Comma-separated cipher suites for the HTTPS proxy listener, using Go cipher-suite names (e.g. TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256). Default: Go defaults. Honors TLS_CIPHER_SUITES.
  -tls-client-ca-file string
    	Path to the PEM-encoded CA bundle used to verify client certificates when --mtls-mode is optional or required.
  -tls-key-file string
    	Path to the PEM-encoded server private key.
  -tls-min-version string
    	Minimum TLS version for the HTTPS proxy listener. Accepted values: VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13. Default: VersionTLS12 (applied when empty). Honors TLS_MIN_VERSION.
  -upstream-max-retries int
    	Number of additional dial attempts before returning 502. Only dial-class failures (DNS, connection refused) are retried. Smooths the case where a freshly-created sandbox is not yet ready. 0 disables retries. (default 3)
  -upstream-retry-initial-delay duration
    	Wait before the first retry; subsequent waits double up to --upstream-retry-max-delay. (default 200ms)
  -upstream-retry-max-delay duration
    	Upper bound on the per-iteration retry backoff. (default 800ms)
  -version
    	Print version information and exit.
  -zap-devel
    	Development Mode defaults(encoder=consoleEncoder,logLevel=Debug,stackTraceLevel=Warn). Production Mode defaults(encoder=jsonEncoder,logLevel=Info,stackTraceLevel=Error)
  -zap-encoder value
    	Zap log encoding (one of 'json' or 'console')
  -zap-log-level value
    	Zap Level to configure the verbosity of logging. Can be one of 'debug', 'info', 'error', 'panic' or any integer value > 0 which corresponds to custom debug levels of increasing verbosity
  -zap-stacktrace-level value
    	Zap Level at and above which stacktraces are captured (one of 'info', 'error', 'panic').
  -zap-time-encoding value
    	Zap time encoding (one of 'epoch', 'millis', 'nano', 'iso8601', 'rfc3339' or 'rfc3339nano'). Defaults to 'epoch'.