Suppose I want to give a computer to someone that runs an application. I want to avoid that the program can be copied to another computer or be tampered with. For that, I want to encrypt the folder that contains the program and would like to make it so that only the host OS (Linux) on that device can decrypt it (ie. also avoid moving the disk between computers). There is no TPM in the computer. Secure boot is already running, but is seems that this gets reset when resetting the CMOS. The application requires network, so that is already available.
Is this possible? I don't really see how this can be done, if possible. And it not, how far can I get to make it as difficult as possible?