DeepSeek Elastic Compute (DSec)

TL;DR Highlight

DeepSeek's DSec runs about 3M sandboxes a day on 160 nodes for agentic training

Who Should Read

A platform developer who must spin up sandboxes at scale for agent training and evaluation and is designing the infrastructure

Core Mechanics

One SDK covers four sandbox backends
- FnCall, container, microVM and full-VM backends are exposed through a unified SDK.
- DSec coordinates placement and lifecycle across the cluster.
Environments are built from versioned layers
- Each environment is composed of independently versioned layers.
- Image data is loaded on demand from 3FS (Fire-Flyer File System), a distributed filesystem.
Resources are managed for high density
- It combines memory sharing, reclamation and CPU scheduling.
- The paper says latency-sensitive performance is preserved under high-density overcommit.
Co-designed with the RL framework
- Stateful rollout execution is decoupled from preemptible GPU training.
- Sandbox lifecycle is coordinated with training to keep rollout state and reclaim idle resources.
- It also mitigates agent misbehavior such as reward hacking.

Community Reactions

Commenters were amazed at 380K concurrent sandboxes on 160 nodes
- A comment noted these are Epyc-based server nodes.
Opinion that agents are becoming top cloud consumers
- A commenter said AI agents are rapidly becoming the biggest consumers of cloud resources.
Opinion that unpredictable workloads make this hard
- A comment contrasted a CPU-bound PDF conversion agent with a mostly network-waiting Q&A agent.
- The commenter wants tech that resizes CPU and memory without restarting a container.
Opinion that it resembles Google's ax
- Several comments said it looks similar to Google's ax (github.com/google/ax).

How to Apply

Classify your sandbox types by task
- List your agent tasks and map each to FnCall, container, microVM or full VM by the isolation it needs.
- Find tasks that use heavier isolation than necessary.
Split environment images into versioned layers
- Separate base, dependencies and task files into layers and version each.
- Look at loading data on demand instead of pulling whole images each time.
Add a reward hacking checklist for rollouts
- Check whether the agent can reach evaluation scripts or answer files inside the sandbox.
- If it can, make those paths read-only or hidden.

Try It

copy & run

# Paste into Claude or ChatGPT (simplified version of the paper's ideas: sandbox design review)

Our agent training/evaluation environment is: {{environment description}}
Task types: {{task list}}

Review the design using these criteria.
1. For each task, pick an isolation level among FnCall / container / microVM / full-VM and explain why, in a table.
2. Propose a way to split the environment image into independently versioned layers.
3. List paths where the agent could tamper with rewards or answer files (reward hacking) and how to block them.

Next step: pick the riskiest path and test whether it can actually be reproduced.

Terminology

SandboxAn isolated environment, like a lab, where an agent can run commands without affecting the outside.

microVMA tiny virtual machine with stronger isolation than a container and lighter weight than a full VM.

rolloutIn RL, one full attempt where the model interacts with an environment from start to finish.

reward hackingWhen a model exploits loopholes in the scoring instead of actually solving the task.

3FSFire-Flyer File System, a distributed filesystem shared across the cluster.

OvercommitAllocating more resources than physically exist, like hotel overbooking.