DeepSeek published a paper on DSec, a sandbox infrastructure for agentic training. It supports FnCall, container, microVM and full-VM backends through one SDK. DSec manages placement and lifecycle across clusters. It composes environments from versioned layers. Memory sharing, reclamation and CPU scheduling enable high-density execution. Image data loads on demand from a distributed filesystem. DSec decouples stateful rollout from GPU training. It coordinates sandbox lifecycle with training to preserve rollout state. DSec mitigates agent misbehavior like reward hacking. A single unit spans 160 nodes and serves 3M sandboxes daily. It supports 380,000 concurrent sandboxes. It sustains 5,000 sandbox creations per second.
What it unlocks
Running large-scale agentic training with isolated, stateful environments at high density.
- 160 nodes per unit
- 3M sandboxes per day
- 380,000 concurrent sandboxes
- 5,000 sandbox creations per second
Sources