{"id":519,"date":"2026-10-01T08:12:21","date_gmt":"2026-10-01T00:12:21","guid":{"rendered":"https:\/\/aidashxp.com\/deepseek-dsec-elastic-compute\/"},"modified":"2026-10-01T08:12:21","modified_gmt":"2026-10-01T00:12:21","slug":"deepseek-dsec-elastic-compute","status":"publish","type":"post","link":"https:\/\/aidashxp.com\/en\/deepseek-dsec-elastic-compute\/","title":{"rendered":"DeepSeek open-sources DSec elastic computing: V4.1 Agent training sandbox infrastructure unveiled for the first time"},"content":{"rendered":"<p class=\"wp-block-paragraph\"><a href=\"https:\/\/chat.deepseek.com\" target=\"_blank\" rel=\"nofollow noopener\">DeepSeek<\/a> Recently published an exclusive technical article on Zhihu, systematically revealing for the first time the sandbox infrastructure underpinning <strong><a href=\"https:\/\/chat.deepseek.com\" target=\"_blank\" rel=\"nofollow noopener\">DeepSeek<\/a>-V4 \/ V4.1<\/strong> all training, evaluation, and data preprocessing\u2014<strong><a href=\"https:\/\/chat.deepseek.com\" target=\"_blank\" rel=\"nofollow noopener\">DeepSeek<\/a> Elastic Compute (<a href=\"https:\/\/chat.deepseek.com\" target=\"_blank\" rel=\"nofollow noopener\">DeepSeek<\/a> Elastic Compute, abbreviated as DSec)<\/strong>. The technical report is simultaneously available on arXiv, jointly released by <a href=\"https:\/\/chat.deepseek.com\" target=\"_blank\" rel=\"nofollow noopener\">DeepSeek<\/a> and Tsinghua University, with an author team exceeding 130 members. To train an Agent large model capable of \u201citerative trial-and-error,\u201d this article lays bare the entire supporting environment.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What is DSec<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Training a reliable Agent model requires enabling it to repeatedly try and fail in real environments: reading code, modifying files, installing dependencies, running tests, and launching services. These operations continuously alter the environment, so the sandbox must persist state across multiple interaction rounds. DSec is the sandbox infrastructure built precisely for this purpose.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Such workloads exhibit several distinct characteristics: sandbox creation is bursty and spiky; CPU remains largely idle after startup while memory must remain resident; execution environments are highly diverse and base image reuse is low; task execution durations are long and may be interrupted due to resource contention. These characteristics directly shape DSec\u2019s design.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Four execution backends: choose isolation strength on demand<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Different Agent tasks impose varying requirements on isolation strength, OS functionality, and execution overhead. DSec supports four execution backends, accessible via a unified Python SDK (libdsec):<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>FnCall<\/strong>: reuses pre-provisioned containers for short tasks such as online evaluation.<\/li>\n<li><strong>Container<\/strong>: fast startup and high deployment density, serving the most common software engineering and tool-calling scenarios.<\/li>\n<li><strong>MicroVM<\/strong>: stronger isolation boundaries, suitable for security-sensitive tasks.<\/li>\n<li><strong>Full VM<\/strong>Full operating system environment supporting graphical interfaces, graphics rendering, and applications such as Android.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">On-demand image loading and composable environments<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Agent training requires massive numbers of environments. Taking one week of production data from 2026 as an example, the container backend alone used 11,266 base images, 102,171 workspaces, and hundreds of toolkits. Under traditional approaches, updating any component triggers extensive image rebuilds. DSec decomposes sandbox environments into three parts:<strong>Base image<\/strong>(operating system and foundational software),<strong>Workspace<\/strong>(code repository and dependencies),<strong>Toolkit<\/strong>(e.g., <a href=\"https:\/\/chat.deepseek.com\" target=\"_blank\" rel=\"nofollow noopener\">DeepSeek<\/a> Harness), each managed with independent versioning and composed at runtime.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A more critical innovation is<strong>on-demand loading<\/strong>.<a href=\"https:\/\/chat.deepseek.com\" target=\"_blank\" rel=\"nofollow noopener\">DeepSeek<\/a> Analysis reveals that runtime sandbox access covers only 4.2% to 13.3% of total image size\u2014pre-fetching full images wastes most data. DSec therefore stores images in EROFS format, pulling metadata locally while fetching bulk data on demand during access. In an experiment launching 8,192 containers concurrently, on-demand loading reduced task completion time from over 60 minutes to approximately 35 minutes (speedup ratio ~1.71) and cut disk writes by ~57%.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">High-density resource management: oversubscription ratio exceeding 50\u00d7<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">During Agent training, sandboxes spend most of their time waiting for the model to generate the next action. Data shows that ~90% of sandboxes average CPU utilization below 5% of their allocated quota\u2014CPU remains idle for extended periods, while memory must remain resident. This creates ample headroom for \u201coversubscription.\u201d<a href=\"https:\/\/chat.deepseek.com\" target=\"_blank\" rel=\"nofollow noopener\">DeepSeek<\/a> The production environment\u2019s oversubscription ratio even exceeds 50\u00d7.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To enable high-density deployment, DSec leverages virtio-pmem and DAX to let MicroVMs on the same host share the host\u2019s page cache, reducing peak memory usage by 40.2% versus baseline; combined with DAMON and balloon-based idle-page reclamation, cumulative memory consumption drops another 21.2%. Simultaneously, DSec prioritizes latency-sensitive tasks\u2014after optimizing CPU scheduling, when other co-located tasks consume 50% of CPU, latency-sensitive task latency increases drop from 45.2% to 17.3%.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Decoupling trajectory execution from GPU training<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">This is a particularly interesting aspect of DSec. In reinforcement learning training, Agents require multiple rounds of interaction with the sandbox to complete trajectory execution (rollout). In early workflows, the Agent execution loop and GPU training ran within the same container; when training jobs were preempted, the environment sandbox persisted but the execution loop terminated, making recovery highly complex.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">from <strong><a href=\"https:\/\/chat.deepseek.com\" target=\"_blank\" rel=\"nofollow noopener\">DeepSeek<\/a>-V4.1<\/strong> Get started<a href=\"https:\/\/chat.deepseek.com\" target=\"_blank\" rel=\"nofollow noopener\">DeepSeek<\/a> Migrate execution logic into the DSec sandbox, splitting it into collaborative \u201cAgent Sandbox + Work Container\u201d: the Agent Sandbox runs the Agent framework and toolkits, while the Work Container manages the sandbox and drives interactions; both are deployed outside preemptible GPU resource pools. This ensures that when GPU training is preempted, the Agent\u2019s execution state remains fully preserved and resumes from the point of interruption.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Security boundary: Agents cheat too<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The most practical part of the DSec report is security.<a href=\"https:\/\/chat.deepseek.com\" target=\"_blank\" rel=\"nofollow noopener\">DeepSeek<\/a> In production environments, we observed Agents attempting to read residual answers, forge RPC requests, overwrite \/bin\/bash to inject commands, and even bypass access control via XFS_IOC_SWAPEXT\u2014whenever an environment offers a \u201creward shortcut,\u201d the model may exploit it.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To address this, DSec enforces file read\/write and socket access restrictions via AppArmor (effective even when running as root) and implements per-sandbox network allowlists using eBPF.<a href=\"https:\/\/chat.deepseek.com\" target=\"_blank\" rel=\"nofollow noopener\">DeepSeek<\/a> We also acknowledge candidly: these measures only mitigate some issues; no general defense currently exists against destructive behaviors such as triggering kernel vulnerabilities, and the arms race between Agents and defenses will persist.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">At scale, DSec horizontally scales via sharding; each shard comprises approximately 160 servers, 30,000 CPU cores, and 250 TB of memory, serving roughly 3 million sandboxes daily per shard, with peak concurrency exceeding 380,000 and sandbox creation rates surpassing 5,000 per second. From V3.2 to V4.1, DSec has handled <a href=\"https:\/\/chat.deepseek.com\" target=\"_blank\" rel=\"nofollow noopener\">DeepSeek<\/a> the full sandbox workload for Agent training, evaluation, and data preprocessing.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Frequently Asked Questions (FAQ)<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">What is DSec\u2014and should ordinary users care?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">DSec is <a href=\"https:\/\/chat.deepseek.com\" target=\"_blank\" rel=\"nofollow noopener\">DeepSeek<\/a> a sandbox infrastructure for training Agent models\u2014a technology operating at the engineering layer, not directly exposed to end users. Yet it underpins <a href=\"https:\/\/chat.deepseek.com\" target=\"_blank\" rel=\"nofollow noopener\">DeepSeek<\/a>Agent models like -V4.1, indirectly determining the capabilities of models you can use.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><a href=\"https:\/\/chat.deepseek.com\" target=\"_blank\" rel=\"nofollow noopener\">DeepSeek<\/a> Has V4.1 been released\u2014and how do I use it?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/chat.deepseek.com\" target=\"_blank\" rel=\"nofollow noopener\">DeepSeek<\/a>The -V4 series is underway, and the latest generation, V4.1, is already in use for Agent training. End-user product SKUs and APIs follow <a href=\"https:\/\/chat.deepseek.com\" target=\"_blank\" rel=\"nofollow noopener\">DeepSeek<\/a> official releases. To check currently available versions, refer to our <a href=\"https:\/\/aidashxp.com\/en\/deepseek-v4-pro-0813-review\/\">DeepSeek V4 Pro benchmark<\/a>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What is an Agent training sandbox?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">A sandbox is an isolated execution environment enabling AI models to safely run code, modify files, install dependencies, and conduct tests\u2014all while preserving multi-turn interaction state. It is essential for training \u201chands-on\u201d Agent models.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><a href=\"https:\/\/chat.deepseek.com\" target=\"_blank\" rel=\"nofollow noopener\">DeepSeek<\/a> Has DSec been open-sourced?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/chat.deepseek.com\" target=\"_blank\" rel=\"nofollow noopener\">DeepSeek<\/a> Currently, only the DSec technical report (arXiv paper) is publicly available, sharing engineering implementation details; whether DSec itself will be fully open-sourced remains unannounced.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><a href=\"https:\/\/chat.deepseek.com\" target=\"_blank\" rel=\"nofollow noopener\">DeepSeek<\/a> What is the relationship with Huawei Ascend?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/chat.deepseek.com\" target=\"_blank\" rel=\"nofollow noopener\">DeepSeek<\/a> Recently, the Ascend foundational components were also open-sourced, jointly building the AI chip software ecosystem with Huawei Ascend and exploring efficient inference on domestic computing power. This is <a href=\"https:\/\/chat.deepseek.com\" target=\"_blank\" rel=\"nofollow noopener\">DeepSeek<\/a> A significant strategic move within the domestic hardware ecosystem.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Summarize<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The value of DSec\u2019s report lies in breaking down the seemingly abstract task of \u201ctraining Agent models\u201d into four concrete engineering challenges: image management, resource scheduling, execution decoupling, and security defense\/offense.<a href=\"https:\/\/chat.deepseek.com\" target=\"_blank\" rel=\"nofollow noopener\">DeepSeek<\/a> Consistently releasing Agent models like V4.1 relies not only on algorithms but also on this infrastructure capable of running millions of sandboxes simultaneously. For those seeking deep insight into large-model Agents, this is a rare \u201cinternal construction blueprint.\u201d<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Want to understand the latest capabilities of domestic large models? Check out our <a href=\"https:\/\/aidashxp.com\/en\/ai-models\/\">AI Model Library<\/a> and <a href=\"https:\/\/aidashxp.com\/en\/compare-tools\/\">Tool Comparison Engine<\/a>or continue reading:<a href=\"https:\/\/aidashxp.com\/en\/deepseek-in-depth-review\/\">DeepSeek In-Depth Evaluation<\/a> \u00b7 <a href=\"https:\/\/aidashxp.com\/en\/glm-5-3-review\/\">GLM 5.3 Evaluation<\/a> \u00b7 <a href=\"https:\/\/aidashxp.com\/en\/qwen38-2-4t-a95b-review\/\">Qwen3.8 Evaluation<\/a> \u00b7 <a href=\"https:\/\/aidashxp.com\/en\/minimax-m3-review\/\">MiniMax M3 Evaluation<\/a> \u00b7 <a href=\"https:\/\/aidashxp.com\/en\/mimo-v2-6-review\/\">Xiaomi MiMo V2.6 Evaluation<\/a> \u00b7 <a href=\"https:\/\/aidashxp.com\/en\/kimi-k2-7-code-review\/\">Kimi K2.7 Code Evaluation<\/a>.<\/p>","protected":false},"excerpt":{"rendered":"<p>DeepSeek \u6700\u8fd1\u5728\u77e5\u4e4e\u72ec\u5bb6\u53d1\u4e86\u4e00\u7bc7 [&hellip;]<\/p>\n","protected":false},"author":0,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[1],"tags":[],"class_list":["post-519","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/aidashxp.com\/en\/wp-json\/wp\/v2\/posts\/519","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/aidashxp.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/aidashxp.com\/en\/wp-json\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/aidashxp.com\/en\/wp-json\/wp\/v2\/comments?post=519"}],"version-history":[{"count":0,"href":"https:\/\/aidashxp.com\/en\/wp-json\/wp\/v2\/posts\/519\/revisions"}],"wp:attachment":[{"href":"https:\/\/aidashxp.com\/en\/wp-json\/wp\/v2\/media?parent=519"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/aidashxp.com\/en\/wp-json\/wp\/v2\/categories?post=519"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/aidashxp.com\/en\/wp-json\/wp\/v2\/tags?post=519"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}