Many academic clusters support Apptainer (formerly Singularity) for reproducible environments. Here we combine that with Nix for an even more reproducible environment.

Building an autograder for a binary exploitation course, discovering Docker won't let you disable ASLR, and ending up running student exploits inside a QEMU VM on Gradescope.