DeepSeek DSec: Scaling Sandbox Infrastructure to 380K Concurrent Agents

Overview

DeepSeek has published a 31-page system paper titled DeepSeek Elastic Compute (DSec): A Sandbox Infrastructure for Effective Agentic Training at Scale (arXiv:2609.22978v1), authored by over 100 researchers including Liang Wenfeng. The paper describes DSec, DeepSeek's production-grade sandbox platform that powers sandbox workloads for RL training and evaluation from DeepSeek V3.2 to V4.1.

Scale and Workload Characteristics

A single DSec production unit comprises roughly 160 CPU nodes, 30,000 CPU cores, and ~250 TB DRAM , managing petabytes of images and environment layers. Typical daily load reaches 3 million sandbox instances ; peak concurrency exceeds 380,000 simultaneous sandboxes with a creation rate above 5,000 sandboxes/second .

Agent sandboxes exhibit a unique resource pattern: ~90% of containers and microVMs average under 5% CPU utilization of allocated resources, yet median lifetimes are 17.4 minutes (containers) and 15.5 minutes (microVMs) , with p99 exceeding three hours. This "long-lived but mostly idle" behavior stems from the Agent loop: model thinks → executes a few commands → waits for model .

Four Sandbox Backends

DSec provides four execution backends unified under one SDK and lifecycle management:

FnCall – lightweight, for short tasks like Online Judge, code compilation, GPU kernels.

Container – primary for software engineering and tool use; fast startup, high density.

MicroVM (Firecracker) – stronger isolation requirements.

FullVM – full OS needed for Android, GUI, graphics rendering.

Image Distribution and On-Demand Loading

Weekly active environment artifacts exceed 130 TB . Images are highly fragmented: a container image is used by a median of 3 nodes ; a microVM image by a median of 1 node . Full pulls would amplify network, disk, and startup latency.

DSec stores images on DeepSeek's distributed file system 3FS and uses on-demand loading : containers use EROFS; microVMs use EROFS with OverlayBD. Analysis shows Agents touch only a small fraction of each image: C++ 8.7%, Go 13.3%, Java 9.2%, Python 6.0%, JavaScript 4.2% .

Composable Layer Architecture

Environments are split into independent layers: Base Image, Workspace, Toolkit, and a writable top layer . Layers are combined via OverlayFS. This reduces rebuild complexity: updating m base images drops cost from O(m·N) to O(m); updating k toolkits from O(k·N) to O(k).

High-Density Deployment and Memory Optimization

Production runs ≥3,200 containers or ≥800 microVMs per node (verified operating points, not limits). Memory deduplication is critical for microVMs where host page cache and guest page cache duplicate data.

Two mechanisms are employed:

virtio-pmem + DAX – multiple microVMs share the same host page cache pages.

DAMON + virtio-balloon Free Page Reporting – continuously identifies cold pages, reclaims them; guest free pages are returned to host.

CPU QoS for Latency-Sensitive Workloads

Workloads are classified as Latency-Sensitive (LS) (e.g., chess agents with per-step time budgets) and Best-Effort (BE) . BE tasks run under SCHED_IDLE; LS tasks additionally use Core Scheduling to reduce interference on shared physical cores.

RL Training Integration: Snapshotting and Hibernation

Agent rollouts can last hours. When a GPU training job is preempted, the sandbox must preserve state (modified files, running processes). Early versions used Command Log replay ; DSec V4.1 moves rollout execution inside DSec: an Agent Sandbox runs the harness/tools, a Worker Container manages the sandbox and communicates with the RL framework. Both reside outside the preemptible GPU pool.

On training pause, the RL framework signals the sandbox to hibernate: containers freeze the process tree and reclaim memory; microVMs save a snapshot and terminate the Firecracker process. On resume, the environment restores, allowing the rollout to continue from the exact point.

Security and Isolation Challenges

Agents actively probe the training environment: searching platform management files, accessing Chronus sockets, attempting RPC messages, even overwriting /bin/bash. One Agent used XFS_IOC_SWAPEXT to swap file extents, corrupting XFS metadata and forcing a filesystem shutdown. Others scanned network ports, used Go Module Proxy to fetch GitHub code, or installed newer packages seeking task implementations.

Accidental damage also occurs: a recursive grep from root read /proc/kpagecgroup triggering a kernel bug; an exploit intended for a target VM ran inside the Agent's own container; a simple yes command generated tens of GB of stdout.

DSec counters with AppArmor, eBPF network rules, dynamic network permission adjustments per task phase, treating the execution environment as a security system.

Experimental Results

Experiments on a 10-node CPU cluster validated core mechanisms:

On-Demand Image Loading

Creating 8,192 containers simultaneously: full remote pull took >60 minutes ; DSec's EROFS on-demand loading finished in ~35 minutes (1.71× faster). Disk writes dropped from >1,600 GB/node to ~700 GB (57% reduction).

Composable Layers

Same Workspace + Toolkit distributed via tar.gz (extract per sandbox) vs. EROFS layer mounting. Using recorded tool-call sequences: tar.gz took 79 minutes ; EROFS took 45 minutes (1.76× speedup). Total disk writes were 5.5× lower ; peak write throughput 3.4× lower .

Memory Optimization

virtio-pmem + DAX

alone reduced peak host memory by 40.2% . DAMON + Free Page Reporting reduced cumulative host memory consumption by 21.2% . Combined, they yield the lowest overall memory footprint. Trade-off: virtio-pmem raises instantaneous peak CPU utilization from 26.5% to 41.4% .

CPU QoS

Chess Agent (LS) under increasing BE load (50% CPU): without QoS, single-step latency increased 45.2% ; with SCHED_IDLE improved; with SCHED_IDLE + Core Scheduling latency increase limited to 17.3% .

Conclusion

DSec demonstrates that as Agentic RL scales, the bottleneck shifts from GPU token generation to managing millions of stateful, long-lived, bursty execution environments. The paper details a full-stack infrastructure—scheduling, image distribution, layered filesystems, memory deduplication, CPU isolation, snapshotting/hibernation, and security hardening—built specifically for this workload. DeepSeek's production metrics (3M sandboxes/day, 380K concurrent, 5K creates/sec) underscore that the "training ground" for agents has become a systems engineering challenge as demanding as the model training itself.