I'd recommend using resinOS as the base. And then running your application inside a Raspbian container.

That will give you a read-only resinOS (based on Yocto. meta-resin layer). If you rpi is connected to the internet, you can use resin.io to remotely push application container updates and access the pi over a vpn.

https://docs.resin.io/learn/getting-started/raspberrypi3/nod...

Disclosure, I work at resin.io in the OS team on meta-resin.

The base resinOS is open source. And we are open-sourcing the rest of our stuff in due time as well.