# Golden image factory for AWS, Azure, and GCP

> A managed VM image factory. Primcoat builds, hardens, scans, signs, and publishes golden images to AWS, Azure, GCP, Hyper-V, VMware, and OpenShift — without you writing a line of Packer or Ansible.

Primcoat is a fully managed VM image factory. Describe the image you want — operating system, hardening policy, software, and destinations — and Primcoat builds it, hardens it, scans it, signs it, and ships it to your cloud.

Every build runs the same six phases, in order:

1. **Fetch** — pull a verified upstream cloud image or ISO.
2. **Provision** — install your packages and run your Ansible hooks.
3. **Harden** — apply CIS L1/L2 or STIG with OpenSCAP auto-remediation.
4. **Validate** — re-scan for a compliance score, then scan for CVEs.
5. **Attest** — generate an SBOM, sign with Cosign, attach SLSA provenance.
6. **Publish** — convert per destination and ship to your clouds.

What makes it different:

- **You bring configuration, not code.** No Packer HCL to write, no Ansible playbooks to maintain, no build fleet to babysit. Define the OS, the hardening policy, the software, and the destinations; Primcoat owns everything in between.
- **The OS you already run.** Ubuntu, RHEL, Debian, AlmaLinux, Rocky, Windows Server. Hardening a golden image should not require migrating to somebody else's base operating system.
- **Evidence, not assurances.** Every build emits a compliance report, a CycloneDX and SPDX SBOM, a CVE scan, a Cosign signature, and SLSA provenance. When an auditor asks what is in the image, the answer already exists.

Publishing destinations: AWS EC2, Azure Compute Gallery, Google Cloud, Hyper-V, VMware, OpenShift Virtualization, and air-gapped / raw.

---

Source: https://primcoat.app/
Primcoat — a managed VM image factory. https://primcoat.app