The department rents one box; every course is a project

The CS department used to run on per-student cloud credits, expiring in May, administered by a spreadsheet.

Now the department chair rents one bare metal server at a flat monthly rate into a pool. Every instructor is a pool member with the user role: they deploy containers, they can't rent or delete servers. Each course is a project with max_containers set to the roster size, so a 40-seat course can't quietly become 400 containers. Project-level permissions apply to every container in it.

Three hundred students across seven courses fit on one box because most containers idle most of the time, and idle ones share disk blocks and cached binaries with their siblings. The bill doesn't move when a course adds a student.