DeepSeek publishes DSec, a sandbox platform serving 3 million agent training environments a day

DeepSeek released a technical report on DeepSeek Elastic Compute (DSec), the sandbox infrastructure it uses internally to train and evaluate agentic AI models at scale, disclosing throughput numbers for a system that runs millions of isolated execution environments per day.

What's new

According to the paper's abstract, a single production-scale unit of DSec spans around 160 nodes and serves about 3 million sandboxes per day. In production, the system supports more than 380,000 concurrent sandboxes and sustains over 5,000 sandbox creations per second. DSec exposes four kinds of sandbox backend through one SDK: FnCall, container, microVM, and full-VM, chosen depending on how much isolation a given training task needs. It loads image data on demand from Fire-Flyer File System (3FS), DeepSeek's own cluster-wide distributed filesystem, and combines memory sharing, memory reclamation, and CPU scheduling to run sandboxes at high density on shared hardware.

The system is co-designed with DeepSeek's reinforcement learning framework. It decouples stateful rollout execution, where an agent inspects a repository, calls tools, or runs commands inside its sandbox, from the preemptible GPU training that consumes those rollouts, and coordinates the lifecycle of both so idle resources can be reclaimed without losing rollout state. The paper also describes mechanisms aimed at agent misbehavior specifically, including reward hacking, where a model finds a way to score well on a training signal without doing the intended task.

Context

Training an AI agent with reinforcement learning requires giving it somewhere to actually act: a sandboxed environment where it can run code, call tools, or interact with services, then get scored on the outcome. That is a fundamentally different infrastructure problem than training a standard language model, because each sandbox needs to hold state across a long interaction, draws from a large and varied set of environment images with limited reuse between them, and gets created and destroyed constantly at scale. DeepSeek's paper argues this workload needs a dedicated elastic platform rather than a single general-purpose sandbox runtime, and DSec is presented as the system the company built after concluding existing tooling wasn't built for that pattern.

Why it matters

The scale figures here, millions of sandboxes a day, hundreds of thousands running concurrently, thousands created every second, are a concrete data point on how much infrastructure now goes into training agentic models before a single user-facing capability ships. Papers like this also function as recruiting and credibility signals for frontier labs: publishing the engineering behind a training pipeline is a way of demonstrating operational scale that competitors have to either match or explain around. For teams outside DeepSeek building their own agent-training infrastructure, the paper's specific design choices, decoupling rollout execution from GPU training, layered environment composition, on-demand image loading from a distributed filesystem, are a documented alternative to building a sandbox platform from scratch.