Immutable, security-scanned server images from one plain-English request
A pipeline of specialized agents that researches the target software, generates Packer and Terraform templates, validates them, builds the image, and runs a security scan, with human approval at each critical gate.
Outcome
One request produces a hardened, scanned, review-ready image, with humans in control at every gate.
Global engineering software enterprise, with a platform team shipping server images across clouds, teams, and deployment zones
Engagement
Autonomous multi-agent image pipeline, built, deployed, and ready to use
Pipeline
Five agent roles, research, code generation, validation, build, and security scan, plus pull-request automation and two human approval gates
Maps to below services
Cloud & Platform Engineering, Agentic AI & AgentOps
Where it started
Server images built from hand-written configuration, with environments drifting apart across deployment zones.
Business problem
Teams hand-wrote the configuration behind every server image, and each build took days. Environments drifted apart from one deployment zone to the next.
Technical barriers
Every image depended on someone reading the target software's official documentation and turning it into correct build configuration by hand.
Agivant's role
Multi-agent pipeline design, Config-as-Code generation, validation and security scanning, and pull-request automation
What Agivant built
Agivant built a coordinated set of agents that takes each request from research through code generation, validation, build, and security scan. Two human approval gates sit after code generation and after scanning, and the finished image arrives as a pull request ready for sign-off. Value in days and weeks.
Documentation research
Reads the target software's official documentation and produces the exact steps needed to build its image.
Config-as-Code generation
Generates Packer and Terraform templates, so every build is declarative, idempotent, and repeatable.
Two-phase validation
Checks generated code for syntax, then re-validates it against a documentation-derived checklist, looping back on any gap.
Build and security scan
Builds the immutable image with Packer and runs a Trivy vulnerability scan, retrying automatically when a build fails.
Pull-request automation
Opens a pull request with an auto-populated review checklist in GitHub or Stash, ready for human sign-off.
Observability and cost tracking
Langfuse tracks agent performance and per-model cost for every image the pipeline produces.
How it is built
Image build
Infrastructure as code
Security scanning
Source control
Observability
Controls
Packer
Terraform
Trivy
GitHub, Stash
Langfuse
Two human approval gates, after code generation and after scanning
Before
Hand-written configuration, days per image, and environment drift across deployment zones.
After
One request producing validated Packer and Terraform templates, an immutable build, a Trivy scan, and a review-ready pull request.
Proof in production
In a demonstration run, one plain-English request for a Langflow image went through research, code generation, validation, build, and a clean security scan, ending in an auto-created pull request. Every stage streamed live, with human approval gates along the way, and the image was built in minutes.
Measured results
A production-ready image, minted and shipped from one request.
Minutes
Image build time in the demonstration run
Zero drift
Immutable, idempotent builds every time
Every build
Security-scanned with Trivy before release
Two
Human approval gates on every image
The repeatable pattern
Reusable asset
Declarative Packer and Terraform templates hold environment parity across every deployment zone and cloud target, so images stay standard across clouds and teams. Every build amplifies the next.
Challenges overcome
Making sure only correct configuration reaches the build stage, recovering from failed builds automatically, and keeping an autonomous pipeline fully auditable through human gates.
.png)