There's the dm-verify path. In a locked down configuration, the os is updated as binary deltas. Your system partition is read only. You lose the flexibility of

There's the dm-verify path. In a locked down configuration, the os is updated as binary deltas. Your system partition is read only. You lose the flexibility of a general os though.