OpenDsec

English

简体中文

English

简体中文

Appearance

OpenDsecAn isolated sandbox for every rollout

Run large fleets of Firecracker microVMs, containers and QEMU VMs on your own machines, for reinforcement-learning rollouts and code-executing agents. Implements DeepSeek's DSec paper and speaks the E2B API.

Get started
View on GitHub
One microVM, start to fork
createcold boot to first command~100 ms
pausesnapshot, then exit; memory freed
resumerestore; processes carry on~50 ms
fork ×8copies with memory; source pauses~10 ms
restore ×64concurrent on one node, shared pages~0.2 s
python:3.12 · 2 vCPU · typical, measured on bare metal

microVMs in about 0.1 s

A Firecracker VM cold-starts in about 0.1 s, is created from a memory snapshot in about 55 ms, and resumes from a pause in about 50 ms.

Fork and memory snapshots

fork(count=N) clones a running VM with its memory, pausing the source for about 10 ms. Copies on one node share pages; other nodes pull from the source node.

Pause a whole task

When training is preempted, pause every sandbox of a task and release its memory. The next call to a paused sandbox resumes it.

E2B compatible

Code written for the E2B SDK runs after changing three environment variables, including commands, files, PTY, ports, snapshots and the code interpreter.

Layered images

Import from any OCI registry, compose layers without copying, and save an environment with pack_diff. The store lives on NFS, CephFS or JuiceFS.

Default-deny network

Allow traffic by domain, CIDR and port per sandbox, changeable while it runs. Enforced with nftables and a DNS proxy.

Isolation

A jailer with a uid per VM, core scheduling against SMT side channels, seccomp, read-only agents and per-session users.

Projects and quotas

Nested projects, hierarchical quotas and bounded delegation. Raft-replicated IAM, mTLS between components, short-lived revocable tokens and audit logs.

Operations

Staged fleet rollouts with automatic rollback, an offline bundle, Prometheus metrics and alerts. Upgrading any component leaves running sandboxes alone.

What OpenDsec is ​

OpenDsec is open-source sandbox infrastructure: it runs large numbers of isolated sandboxes on your own Linux machines, from one machine to a cluster, for reinforcement-learning rollouts and code-executing AI agents. It comes with a Python SDK, a CLI and an E2B-compatible API, under AGPL-3.0.

  • A good fit for: teams whose sandboxes must run in their own data center or offline; RL training that starts thousands of sandboxes at once; forking running environments with their memory; keeping E2B SDK code while moving to your own infrastructure.
  • Not a fit for: wanting a hosted service with no machines to run (there is no hosted OpenDsec); platforms other than Linux x86_64.

How it differs from E2B, Daytona and Modal: see the comparison. Common questions: FAQ.

Measured ​

On bare metal with 2 × AMD EPYC 9Y24 (384 threads), 1.5 TB RAM, NVMe RAID0 and Ubuntu 24.04. These are our own measurements, not figures from the paper; how each was taken is in docs/SPEC.md.

ParameterTypical
microVM cold start
until the first command can run		0.1 s
Create from a memory snapshot
snapshot on the same node		55 ms
Resume after pause
memory fully released while paused		50 ms
Source pause during fork
incremental snapshot, dirty pages only		10 ms
Fork 8 copies to another node
pulled from the source node		0.58 s
Restore 64 copies at once
one node, shared pages		0.2 s
Burst of 5120 microVMs
one 384-thread node		37 s
Burst of 8192 containers
two nodes		0 failed
FnCall create
pre-built pool, through the API		2 ms
E2B code interpreter
Sandbox.create() / first run_code		280 / 45 ms

Architecture ​

The apiserver is stateless and picks nodes with power-of-k over the state the watcher aggregates; the edge on each node decides from real usage. Any component can restart without touching running sandboxes.

Python SDKopendsecctlE2B SDKPython · JSE2B gateway:7400apiserver ×Nstateless · placementpower-of-kIAM · Raft ×3projects · quota · tokenswatcher ×Nprobes edges · scheduling stateedgemicroVM · container · FnCalledgemicroVM · container · full VMedgein each sandbox: aether · chronusShared image storeNFS 4.2 · CephFS · JuiceFS

Swipe sideways to see the whole diagram

Based on the DSec paper ​

OpenDsec implements DeepSeek Elastic Compute (DSec): A Sandbox Infrastructure for Effective Agentic Training at Scale (arXiv:2609.22978). The architecture and most of the design come from the paper. How network policy is enforced, the shared-file-system image store, Firecracker as the main backend, fleet operations and E2B compatibility are our own. The SPEC in the repository marks the source of each design point. We thank the paper's authors for publishing the design in such detail.

OpenDsec is an independent project: not affiliated with, endorsed by or maintained by DeepSeek, and it contains no DeepSeek code. "DeepSeek" and "DSec" belong to their owners and are used here only to name the paper.

Implements the paper DeepSeek Elastic Compute (DSec) (arXiv:2609.22978). An independent project, not affiliated with DeepSeek.

© 2026 Yibo Zhou · Kernflux