The protective base. Built into every image.
Hardened golden images, built and published automatically.
Primcoat is a fully managed VM image factory. Describe the image you want — operating system, hardening policy, software, and destinations — and Primcoat builds it, hardens it, scans it, signs it, and ships it to your cloud.
You bring configuration, not code
No Packer HCL to write. No Ansible playbooks to maintain. No build fleet to babysit. Define the OS, the hardening policy, the software, and the destinations — Primcoat owns everything in between.
The OS you already run
Ubuntu, RHEL, Debian, AlmaLinux, Rocky, Windows Server. Hardening a golden image should not require migrating to somebody else's base operating system.
Evidence, not assurances
Every build emits a compliance report, a CycloneDX and SPDX SBOM, a CVE scan, a Cosign signature, and SLSA provenance. When an auditor asks what is in the image, you have the answer already.
Every build runs the same pipeline.
Not a registry that tracks images somebody else built. The build itself — hardening, scanning, signing, and publishing included.
- 01
Fetch
Pull a verified upstream cloud image or ISO.
- 02
Provision
Install your packages and run your Ansible hooks.
- 03
Harden
Apply CIS L1/L2 or STIG with OpenSCAP auto-remediation.
- 04
Validate
Re-scan for a compliance score, then scan for CVEs.
- 05
Attest
Generate an SBOM, sign with Cosign, attach SLSA provenance.
- 06
Publish
Convert per destination and ship to your clouds.
One definition. Every destination.
Primcoat builds a single hardened base image, then converts and publishes it to each target — injecting the right guest agent and the right disk format for each one.
- AWS EC2
- Azure Compute Gallery
- Google Cloud
- VMware
- OpenShift Virtualization
- Air-gapped / raw
Stop maintaining your image pipeline.
Primcoat builds, hardens, scans, signs, and publishes your golden images — on the operating systems you already run.