Something could manage access to and the run state of containers (just like APKs and other apps running without `ps -Z`) so that the state of the machine can be reset.

And then an instructor could specify policy that would affect which apps and containers run on the machines attached to the management domain (e.g. at test-taking time and also all of the times)

Comparing etckeeper and rpm-ostree's diffs of /etc lately

(where e.g. LVM or btrfs CoW snapshots would need eventual compaction)