Platform
How a build actually runs.
Ten stages, in order, on every image. Nothing is skipped because it was inconvenient, and nothing publishes until it has passed.
Fetch base
Primcoat pulls the upstream image from a verified source cache — official Ubuntu, Debian, AlmaLinux and Rocky cloud images, Red Hat's portal for RHEL, or the Microsoft Evaluation Center for Windows Server. Primcoat checks every artifact against a known SHA256 before it uses the artifact. An upstream monitor watches those sources and queues a fetch when a new release lands.
Provision
Packer boots the base image as a real VM under QEMU/KVM. Primcoat installs your selected catalog packages and runs your own Ansible hooks, with access only to the secrets you declared.
Harden
OpenSCAP evaluates the image against the compliance profile you chose — CIS Level 1, CIS Level 2, or DISA STIG — and auto-remediates. Primcoat selects the correct SCAP Security Guide content from the image's OS family, so OpenSCAP grades a RHEL 9 image against RHEL 9 rules, and an Ubuntu 24.04 image against Ubuntu 24.04 rules.
Validate
A second OpenSCAP pass scores the hardened image, and a CVE scan runs against the installed packages. If the image falls below your compliance threshold, the build fails. It does not publish a non-compliant image and warn you about it later.
Produce SBOM
Primcoat produces a full software bill of materials in both CycloneDX and SPDX, so whichever toolchain your organization has standardized on can consume the artifact.
Sign & attest
Primcoat signs the image with Cosign and attaches SLSA build provenance, giving you a verifiable chain from the upstream base image to the artifact you deploy.
Smoke test
Primcoat boots the image and checks it for responsiveness before it publishes anything. A hardened image that will not boot is a failed build, not a released one.
Inject agents
Each destination needs its own guest agent — the ENA driver for AWS, the Azure Linux Agent, the Google guest environment, VMware Tools, Hyper-V Integration Services, the QEMU guest agent for OpenShift. Primcoat adds these per destination, as a lightweight step on top of the single hardened base.
Convert
Primcoat converts the QCOW2 master to the disk format each destination expects: RAW for AWS, a fixed VHD for Azure, a tarballed RAW for Google Cloud, VHDX for Hyper-V, VMDK for VMware.
Promote
Primcoat assigns the finished artifact to a channel — dev, staging, or prod. Promotion is how a build becomes the image your fleet actually deploys, and it is a single API call your release pipeline can make.
One base image, many variants
The expensive work — provisioning, hardening, scanning, signing — happens exactly once, against a single QCOW2 master. Only the destination-specific parts happen per target: the guest agent, and the disk format.
That matters for more than build time. It means every variant you deploy traces back to the same hardened, scanned, signed base — so the compliance score and the SBOM you show an auditor describe the image running in all of your clouds, not just one of them.
Windows Server, same pipeline
A Windows Server image runs the exact same ten stages as a Linux one. Primcoat provisions it, hardens it against CIS or STIG, scans it, signs it, and publishes it — the same pipeline, start to finish.
See the pipeline run on your own image.
Bring an OS, a compliance profile, and a cloud account. Primcoat handles the ten stages in between.