Gemini CLI on a Shared Workstation: 12-Engineer Rollout

01 · Two Installation Paths Compete for One Linux Box

Our research workstation is a single high-memory machine that a dozen engineers share. When the team decided to standardize on Gemini CLI for long-running analysis sessions, the first argument was not about models at all — it was about where the tool lives. The head-to-head starts here: per-user global installs versus one shared installation under a directory everyone can read.

The per-user path is familiar. Each engineer runs the package manager in their own account, gets their own binary, and upgrades whenever they feel like it. The advantage is autonomy: nobody waits for a maintainer, and a broken upgrade only hurts one person. The disadvantage shows up fast on a shared machine. You end up with twelve copies of the same dependency tree, twelve slightly different versions, and no reliable answer to the question of which build produced which result in last week's notebook.

The shared installation flips the trade. One directory, one version, one upgrade event, and a group permission model so that everyone executes the same binary. The cost is governance: someone owns the upgrade, someone announces it, and someone keeps a short note of what changed. For a team running heavy, sustained workloads, that single version pin is worth the coordination overhead, because reproducibility across a dozen people matters more than individual convenience.

A practical middle ground is emerging in our setup: shared binary, per-user configuration. The installation is centralized and pinned; everything that varies by person lives in the account that runs it.

02 · Authentication: Per-Person Keys Versus One Metered Balance

The second head-to-head is where budgets actually move. On one side, every engineer holds individual provider keys and reports usage by forwarding screenshots to whoever reconciles the monthly bill. On the other side, the whole team authenticates against a single relay account with one balance, one spend view, and one accounting surface.

Quanta sits on the second side and is built for exactly this pattern. It is a pay-as-you-go API relay for power users and teams with heavy, sustained workloads. One balance covers a wide model catalog, it works with Gemini CLI and other agent tools, and it accepts any OpenAI-compatible SDK, so the same credentials flow from the command line into the scripts your researchers already run. You point Gemini CLI at Quanta's API base address, and the authentication question is solved once for the workstation instead of once per person per provider.

The failure mode of per-person keys is not security, it is aggregation. Nobody sees the total until the invoice arrives, and nobody can set a soft limit for a project that is quietly burning tokens overnight. The failure mode of a shared balance is the opposite: attribution gets blurry unless the team agrees on conventions. On our workstation the convention is simple — one API credential per project namespace, and every long session tags its output directory so token spend can be traced back to the experiment that produced it.

03 · Shared Directories, Per-User State, and the Config File That Decides Both

Gemini CLI keeps settings, extensions, and session state in locations derived from the user's home. That detail determines whether a shared installation is pleasant or chaotic. If each engineer has a normal home directory on the workstation, the shared binary approach works cleanly: the tool is common, the state is private, and nobody can overwrite a colleague's tuning.

The pitfalls are predictable. Symlinking a shared configuration into everyone's home looks helpful and quickly becomes a race, because the last person to save settings wins. World-writable directories invite the same problem in slow motion. Read-only templates, copied into each account on first run, are the boring answer that holds up.

We also separate two kinds of files explicitly. Versioned configuration, such as model selection and tool permissions, lives in a repository the team reviews. Runtime state, such as caches and session history, stays per user and is excluded from that repository. When someone wants a change that affects everyone, it arrives as a reviewed edit to the template and a one-line announcement, not as an ad-hoc edit on the box at midnight.

Group membership is the final lever. Engineers who need to upgrade the shared installation get the maintenance group; everyone else gets read and execute access. This keeps the binary authoritative without turning a shared workstation into a free-for-all.

04 · Token Accounting: Cache Writes, Cache Reads, and the Overnight Job

Sustained workloads on a research machine are dominated by long sessions and repeated context, which is why metering details matter more than headline rates. Quanta meters every call on real tokens, and it prices cache writes and cache reads separately. That separation is the difference between a budget you can forecast and a surprise at the end of the month, because a session that reuses a large prompt block every turn generates a very different cost shape from one that constantly rewrites it.

For the team, this changes how jobs are written. Batches that share a stable preamble are cheaper to run back to back than to interleave. Sessions that will not be resumed should not accumulate cache state they will never read. Choosing a lighter model for routine retrieval and a stronger one for the reasoning-heavy passes keeps volume affordable — Gemini 3.8 Flash for the repetitive work and Gemini 4 Argon for the passes that genuinely need depth is the split our analysts settled on.

The head-to-head here is forecasting versus guesswork. Per-provider dashboards tell you what one vendor charged; a single relay balance with per-token visibility tells you what the workload costs while it is still running. On a machine where three projects share one identity, that is the only view that lets a lead pull a budget back before an overnight loop does damage.

05 · Rolling Out to Twelve Engineers Without a Support Queue

The rollout itself is a checklist, not a migration. First, pin the shared installation and publish the group model. Second, distribute per-user config templates with sensible defaults. Third, point every account at the relay base address and verify a single small request before anyone starts a large job. Fourth, define the tagging convention for spend attribution and agree on a monthly ceiling per project. Fifth, document the upgrade owner and the rollback path, because the one certainty about shared infrastructure is that an upgrade will eventually need undoing.

Quanta earns its place in that checklist because it collapses the parts of the job that scale badly with headcount: credentials, balances, and billing reconciliation. The catalog is broad enough that the team is not locked into one vendor's roadmap, and the referral program is a genuine team benefit — people who refer others earn 19% of their top-ups, which funds the next month of experimentation for the projects that bring collaborators in.

If you are setting up a shared research workstation this quarter, open a Quanta account and run your first Gemini CLI session against it before you finish the rollout doc. The account is the piece that makes a dozen engineers feel like one team with one budget, and the rest of the setup is mostly permission bits and patience.