Linux

All you really have to do for that is mount the partition readonly, and have a designated writable data partition for the rest. That can be as simple as setting it ro in your fstab.

How you ship updates can take many forms. If you don't need your distro atomic, you can temporarily remount readwrite, rsync the new version over and make it readonly again. If you want it atomic, there's the classic A/B scheme (Android, SteamOS), where you just download the image to the inactive partition and then just switch over when it's ready to boot into. You can also do btrfs/ZFS snapshots, where the current system is forked off a snapshot. On your builder you just make your changes, then take a snapshot, then zfs/btrfs send it as a snapshot to all your other machines and you just boot off that new snapshot (readonly). It's really not that magic: even Docker, if you dig deep enough, it's just essentially tarballs being downloaded then extracted each in their own folder, and the layering actually comes from stacking them with overlayfs. What rpm-ostree does, from a quick glance at the docs, is they leverage the immutability and just build a new version of the filesystem using hardlinks and you just switch root to it. If you've ever opened an rpm or deb file, it's just a regular tarball and the contents pretty much maps directly to the filesytem.

Here's an Arch package example, but rpm/deb are about the same:

max-p@desktop /v/c/p/aur> tar -tvf zfs-utils-2.2.6-3-x86_64.pkg.tar.zst 
-rw-r--r-- root/root    114771 2024-10-13 01:43 .BUILDINFO
drwxr-xr-x root/root         0 2024-10-13 01:43 etc/
drwxr-xr-x root/root         0 2024-10-13 01:43 etc/bash_completion.d/
-rw-r--r-- root/root     15136 2024-10-13 01:43 etc/bash_completion.d/zfs
-rw-r--r-- root/root     15136 2024-10-13 01:43 etc/bash_completion.d/zpool
drwxr-xr-x root/root         0 2024-10-13 01:43 etc/default/
-rw-r--r-- root/root      4392 2024-10-13 01:43 etc/default/zfs
drwxr-xr-x root/root         0 2024-10-13 01:43 etc/zfs/
-rw-r--r-- root/root       165 2024-10-13 01:43 etc/zfs/vdev_id.conf.alias.example
-rw-r--r-- root/root       166 2024-10-13 01:43 etc/zfs/vdev_id.conf.multipath.example
-rw-r--r-- root/root       616 2024-10-13 01:43 etc/zfs/vdev_id.conf.sas_direct.example
-rw-r--r-- root/root       152 2024-10-13 01:43 etc/zfs/vdev_id.conf.sas_switch.example
-rw-r--r-- root/root       254 2024-10-13 01:43 etc/zfs/vdev_id.conf.scsi.example
drwxr-xr-x root/root         0 2024-10-13 01:43 etc/zfs/zed.d/
...

It's beautifully simple. You could for example install ArchLinux without pacman, by mostly just tar -x the individual package files directly to /. All the package manager does is track which file is owned by which package (so it's easier to remove), and dependency solving so it knows to go pull more stuff or it won't work, and mirror/download management.

How you get that set up is all up to you. Packer+Ansible can make you disk images and you can maybe just throw them on a web server and download them and dd them to the inactive partition of an A/B scheme, and that'd be quite distro-agnostic too. You could build the image as a Docker container and export it as a tarball. You can build a chroot. Or a systemd-nspawn instance. You can also just install a VM yourself and set it up to your liking and then just dd the disk image to your computers.

If you want some information on how SteamOS does it, https://iliana.fyi/blog/build-your-own-steamos-updates/