# Image pipeline

> How a Primcoat build runs: fetch a verified upstream image, provision it under QEMU/KVM with Packer and Ansible, harden it with OpenSCAP, scan it, generate an SBOM, sign it, and publish it to every destination.

Ten stages, in order, on every image. Nothing is skipped because it was inconvenient, and nothing publishes until it has passed.

1. **Fetch base.** Primcoat pulls the upstream image from a verified source cache — official Ubuntu, Debian, AlmaLinux and Rocky cloud images, Red Hat's portal for RHEL, or the Microsoft Evaluation Center for Windows Server. Every artifact is checked against a known SHA256 before it is used. An upstream monitor watches those sources and queues a fetch when a new release lands.
2. **Provision.** Packer boots the base image as a real VM under QEMU/KVM. Your selected catalog packages are installed and your own Ansible hooks run, with access only to the secrets you declared.
3. **Harden.** OpenSCAP evaluates the image against the compliance profile you chose — CIS Level 1, CIS Level 2, or DISA STIG — and auto-remediates. The correct SCAP Security Guide content is selected from the image's OS family, so a RHEL 9 image is graded against RHEL 9 rules and an Ubuntu 24.04 image against Ubuntu 24.04 rules.
4. **Validate.** A second OpenSCAP pass scores the hardened image, and a CVE scan runs against the installed packages. If the image falls below your compliance threshold, the build fails. It does not publish a non-compliant image and warn you about it later.
5. **Generate SBOM.** A full software bill of materials is produced in both CycloneDX and SPDX, so the artifact is consumable by whichever toolchain your organization has standardized on.
6. **Sign & attest.** The image is signed with Cosign and SLSA build provenance is attached, giving a verifiable chain from the upstream base image to the artifact you deploy.
7. **Smoke test.** The image is booted and checked for responsiveness before anything is published. A hardened image that will not boot is a failed build, not a released one.
8. **Inject agents.** Each destination needs its own guest agent — the ENA driver for AWS, the Azure Linux Agent, the Google guest environment, VMware Tools, Hyper-V Integration Services, the QEMU guest agent for OpenShift. These are added per destination, as a lightweight step on top of the single hardened base.
9. **Convert.** The QCOW2 master is converted to the disk format each destination expects: RAW for AWS, a fixed VHD for Azure, a tarballed RAW for Google Cloud, VHDX for Hyper-V, VMDK for VMware.
10. **Promote.** The finished artifact is assigned to a channel — dev, staging, or prod. Promotion is how a build becomes the image your fleet actually deploys, and it is a single API call a release pipeline can make.

Windows builds take longer than Linux builds — typically 60 to 120 minutes — because they are built from an ISO.

---

Source: https://primcoat.app/platform/image-pipeline
Primcoat — a managed VM image factory. https://primcoat.app