Forty vulnerable boxes, reset after every root

A security course needs forty deliberately broken machines and forty students who are allowed to break them further.

Each student gets a pair: an attacker container with the tools, and a target copied from the vuln-lab-3 snapshot with the old Samba and the bad sudo rule. The target's ingress firewall allows traffic from the attacker's IP only and drops everything else; its egress drops everything. A student who gets root on the target can't pivot to the student next door or to the open internet, because the rules sit on the host kernel, outside anything root can touch.

When the box is popped and trashed, the student PUTs the snapshot back. Ninety seconds later it's vulnerable again, ready for the next technique.

The target is disposable, the attacker is contained, and the internet never hears about either.