Say, I would be able to protect my SD or eMMC from being written, either by initramfs (which does not work yet) or maybe a fuse protection.
Then I would have to face the problem, that the “.engine” file needs to be created at least once. For practical reasons I cannot redirect this to RAM, since it would have to be re-created with every cold boot and would slow down the start. I would probably have to have an additional writable device, like an USB stick or so.
Or would it be possible to prepare an engine file once for all and deploy that to other machines, along with the scripts?