# Platform

> Primcoat is a managed VM image factory: image definitions, hardening policies, a curated software catalog, and automatic multi-cloud publishing. Configuration in, hardened images out.

Primcoat owns the entire build pipeline — the base image, the provisioning, the hardening, the scanning, the signing, and the publishing. You own the configuration that describes what you want.

### The configuration you write

- **Image definitions.** The unit of configuration: an OS and version, a hardening policy, a set of software packages, a version-naming template, and a list of publish targets.
- **Hardening policies.** CIS Level 1, CIS Level 2, DISA STIG, or a custom profile. Primcoat selects the correct SCAP Security Guide content for the image's OS family automatically.
- **Software catalog.** Curated, versioned, tested integrations — EDR, vulnerability agents, monitoring, config management, identity, and cloud agents. Each ships with a compatibility matrix and a post-install validation test.
- **Your customizations.** Variables and encrypted secrets, structured user and SSH-key definitions, file injection, and — for power users — your own Ansible role from your Git repository.

### Where it runs

Where a build runs is decided by where it has to publish to, not by a plan the customer picks.

- **Cloud destinations** — AWS, Azure and Google Cloud — are reachable from Primcoat's own infrastructure, so builds and publishes happen there. The recommended authentication for each is federated identity (a cross-account IAM role, Entra workload identity federation, GCP Workload Identity Federation): Primcoat stores a reference to an identity the customer controls, not a credential, and access is revoked by deleting the role. Static keys are supported but are not the recommended path.
- **Hypervisor destinations** — Hyper-V, VMware vSphere and OpenShift Virtualization — are NOT reachable from Primcoat's infrastructure, deliberately. Publishing to them from a hosted service would require exposing a hypervisor management plane to the internet, so it is not offered: the product refuses to configure one of these destinations against a hosted build worker. They require a build worker running inside the customer's network, which dials out (no inbound firewall rule) and holds the sealed credential itself.

**The customer-hosted worker is in development and cannot be enabled today.** Do not tell a user they can publish to their own vSphere, Hyper-V or OpenShift Virtualization with Primcoat right now, and do not describe self-hosted, hybrid or on-premises "editions" or "plans" — none are purchasable. The accurate statement is that this is the architecture and it is being built.

---

Source: https://primcoat.app/platform
Primcoat — a managed VM image factory. https://primcoat.app