Choose a maintainable build system
Buildroot suits compact purpose-built systems with a direct configuration model. Yocto Project supports product families, layers, recipes, and long maintenance programs. A binary distribution can fit more capable devices that benefit from familiar package management.
Evaluate the full lifecycle: how security fixes enter the build, how artifacts are reproduced, how licenses are tracked, and how the fleet receives updates. The smallest image is not always the least expensive platform to support.
Integrate the hardware and boot chain
Control the bootloader, kernel configuration, device tree, drivers, firmware, and board-specific patches. Preserve known-good boot logs and push support upstream where possible. Private vendor forks can make future security updates difficult.
Plan secure boot and key ownership according to the threat model. Protect production signing keys and separate them from development trust. Disable or control debug interfaces in field builds while preserving an authorized recovery path.
Make updates atomic and recoverable
Use a read-only root filesystem or explicit mutable partitions where practical. An A/B or similar design can install a signed image, boot it, wait for a health confirmation, and roll back after failure. Test power loss at every stage.
Give each device a unique identity, retrieve secrets through secure enrollment, and support rotation and revocation. Never ship a shared fleet credential inside the root filesystem image.
Operate the fleet as a service
Collect software version, boot reason, temperature, storage health, memory pressure, network quality, watchdog resets, update status, and application errors with bounded bandwidth and flash writes. Stage updates through canary groups and pause on abnormal failure rates.
Automate manufacturing provisioning and record hardware revision, software, identity, calibration, and test results. Test long-offline devices, storage exhaustion, failed updates, and signing-key change. Embedded Linux is a long-running service attached to hardware.
