DSec is the sandbox infrastructure supporting all of DeepSeek-V4's training, evaluation and data preprocessing pipelines. According to reports, from DeepSeek-V3.2 all the way to V4.1, all sandbox workloads generated by Agent training, evaluation and data preprocessing have been running on DSec.
The workload it faces differs from ordinary cloud computing. During Agent training, the model needs to continuously enter real environments to execute tasks: read code, modify files, install dependencies, run tests, run services; each step changes the current environment, and the next round of interaction must continue from the previous state. Therefore sandboxes must be able to be created quickly and in large batches, yet cannot be destroyed and recreated at every single step.
DeepSeek summarized several obvious characteristics of this kind of workload: creation requests suddenly flood in; the CPU is idle most of the time, but to preserve files and processes, memory must be kept resident; different Agent tasks require very different execution environments, so the base image reuse rate is not high; and the training process may be interrupted because GPU resources are preempted.
DSec needs to simultaneously support four execution backends—FnCall, Container, MicroVM and Full VM—to cover different environment needs from short tasks to complete operating systems. FnCall suits short tasks such as online evaluation; Container mainly handles software engineering and tool calls; MicroVM provides stronger isolation; and Full VM provides a complete operating system, supporting GUI, graphics rendering and even Android applications.