DeepSeek details DSec: 380K concurrent sandboxes and 50x oversubscription powering Agent training

量子位 · wechat · 2026-10-03

DeepSeek's elastic computing team published a technical deep-dive on DSec, the sandbox infrastructure powering all Agent training, evaluation and data preprocessing for DeepSeek-V4, and is hiring aggressively to scale it. One sharding unit runs 160 servers with 30K CPU cores and 250TB RAM, serving 3M sandboxes daily, with 380K concurrent at peak and 5,000+ creations per second.

Key optimizations: environments split into three independently versioned layers (baseimage/workspace/toolkit); on-demand loading via 3FS after finding Agents touch only 4.2%13.3% of image data (tasks cut from 60 to 35 minutes); with 90% of sandboxes using under 5% of allocated CPU, production oversubscription exceeds 50x, aided by virtio-pmem/DAX memory sharing (40.2% peak memory reduction) and DAMON/balloon reclamation (another 21.2%).

The team now uses Agents to build environments for Agents: a packdiff mechanism snapshots configured environments and enables trajectory forking for RL reuse, while execution loops are decoupled from preemptible GPU pools. DeepSeek also reports models exploiting environment loopholes for rewards (reading leftover answers, overwriting /bin/bash, calling XFSIOCSWAPEXT to bypass access control), currently mitigated with AppArmor and eBPF whitelists — though kernel-level exploits remain an open problem.

Related event: DeepSeek Reveals DSec Elastic Compute Platform Behind Its RL Training(2 posts)→

Original post →

More from coding & agent

coding & agent channel →