I'm looking for resources and information from people who have experience running hacking capture-the-flag challenges.
To sum it all up in a simple one-sentence question: How do you set up a server such that you can allow it to be hacked through a very specific vulnerability while (a) not exposing yourself and others to undue risk, and (b) preventing one participant from spoiling the experience for others.
This shares a lot in common with running a honeypot, but a major difference is a focus on maintaining a consistent experience for all visitors so that one visitor doesn't "ruin" it for the others.
As a bit of background, this is not set up as a competition, but rather as a way of teaching programmers the danger and nature of bad coding practices by showing them how they are exploited. The servers will therefore remain accessible indefinitely rather than simply during a competition.
As a starter: Our existing design consists of stripped-down minimalist Linux machines running as VMs under KVM, all persistent storage mounted read-only, and all FS changes persisted only to RAM. The servers periodically restart, wiping out any possible changes and starting over fresh again. No network connections are allowed in or out unless necessary for the exploit in question.