Multi Architecture Provisioning Tool

Spin up cloud machines in seconds. Tear them down just as fast. Spot pricing. Airgap topologies. CI/CD native. Built for operators.

---

What is mapt?

mapt is a command-line tool for provisioning and destroying cloud environments across AWS, Azure, and IBM Cloud. It wraps multi-cloud infrastructure into a single, consistent interface — optimized for cost, speed, and CI/CD integration.

mapt <provider> <target> <create|destroy> [flags]

One pattern. Every cloud. Every OS.

---

Quickstart

Pull the container and provision a Fedora machine on AWS spot:

podman run -d --name mapt-fedora \
    -v ${PWD}:/workspace:z \
    -e AWS_ACCESS_KEY_ID=<key> \
    -e AWS_SECRET_ACCESS_KEY=<secret> \
    -e AWS_DEFAULT_REGION=us-east-1 \
    quay.io/redhat-developer/mapt:latest aws fedora create \
        --project-name my-fedora \
        --backed-url file:///workspace \
        --conn-details-output /workspace \
        --spot

Connection details land at ${PWD}/host, ${PWD}/username, and ${PWD}/id_rsa. Destroy with the same flags, swapping create for destroy.

---

What can you provision?

Instances

Target	AWS	Azure	IBM Cloud
macOS (x86, M1, M2)	docs	—	—
Windows Server	docs	—	—
Windows Desktop	—	docs	—
RHEL	docs	docs	—
RHEL AI	docs	docs	—
Fedora	docs	docs	—
Ubuntu	—	docs	—
IBM Z (s390x)	—	—	docs
IBM Power (ppc64le)	—	—	docs

Services

Service	AWS	Azure	IBM Cloud	Description
Kind	docs	docs	docs	Lightweight Kubernetes via Kind
EKS	docs	—	—	Managed Kubernetes with spot node groups
AKS	—	docs	—	Managed Kubernetes
OpenShift SNC	docs	—	—	Single-node OpenShift for testing
Mac-Pool	docs	—	—	Shared Mac host pool — amortize the 24h minimum

Architectures

Architecture	Providers
x86_64	AWS, Azure, IBM Cloud
arm64	AWS, Azure
s390x	IBM Cloud
ppc64le	IBM Cloud

---

Key features

Spot-optimized provisioning

mapt scans placement scores and pricing across all regions to find the best cost vs. availability balance — no manual region hunting. If a region doesn't have the instance you need, mapt falls back automatically.

mapt aws rhel create --spot \
    --project-name my-rhel --backed-url file:///workspace \
    --conn-details-output /workspace

Hardware-spec instance selection

Describe the machine you need; mapt picks the right instance type:

mapt azure fedora create \
    --arch arm64 --cpus 4 --memory 16 \
    --project-name fedora-arm --backed-url file:///workspace \
    --conn-details-output /workspace

Flags: --arch, --cpus, --memory, --nested-virt, --compute-sizes Details: instance selection docs

Airgap topology

Provision an isolated machine behind a jump bastion. mapt wires up the full network — you get bastion connection details alongside the target host.

mapt aws rhel create --airgap \
    --project-name rhel-airgap --backed-url file:///workspace \
    --conn-details-output /workspace

Outputs: host, username, id_rsa, bastion_host, bastion_username, bastion_id_rsa

Self-destruct timer (serverless mode)

Set --timeout and mapt will tear itself down automatically if the destroy never runs — pipeline crash, lost state, whatever. No orphaned resources, no surprise bills.

Details: serverless mode docs

---

CI/CD integrations

mapt machines register themselves with your CI system at provision time — nothing to configure after the fact.

GitHub Actions self-hosted runner

mapt aws fedora create --spot \
    --install-ghactions-runner \
    --ghactions-runner-repo "https://github.com/your-org/your-repo" \
    --ghactions-app-id "123456" \
    --ghactions-app-installation-id "789012" \
    --ghactions-app-private-key "/path/to/private-key.pem" \
    --project-name fedora-runner --backed-url file:///workspace \
    --conn-details-output /workspace

Auth methods: GitHub App (recommended), PAT, or pre-generated registration token. Supported targets: AWS (Windows, RHEL, Fedora, macOS) · Azure (Windows, RHEL) · IBM Cloud (Power, Z) Details: self-hosted runner docs

GitLab Runner

mapt aws fedora create --spot \
    --glrunner-token <token> \
    --project-name fedora-gitlab --backed-url file:///workspace \
    --conn-details-output /workspace

Supported targets: AWS (Windows, RHEL, Fedora, macOS) · Azure (Windows, RHEL) · IBM Cloud (Power, Z) Details: GitLab runner docs

Tekton tasks

Tekton tasks for dynamic provisioning inside pipelines are available in the tkn/ directory.

---

Running mapt

Container (recommended)

podman run -d --name mapt \
    -v ${PWD}:/workspace:z \
    -e AWS_ACCESS_KEY_ID=<key> \
    -e AWS_SECRET_ACCESS_KEY=<secret> \
    -e AWS_DEFAULT_REGION=us-east-1 \
    quay.io/redhat-developer/mapt:latest aws fedora create \
        --project-name my-env \
        --backed-url file:///workspace \
        --conn-details-output /workspace

The --backed-url volume mount holds your stack state — keep it, you need it to destroy.

Binary

go install github.com/redhat-developer/mapt/cmd/mapt@latest
mapt --help

---

State management

mapt uses Pulumi under the hood. Stack state is stored at --backed-url:

• Local: file:///absolute/path — simplest, works for local dev
• S3: s3://your-bucket — required for serverless mode and shared CI
• Azure Blob: azblob://your-container

The --project-name flag namespaces stacks, so you can run multiple environments from the same backend.

---

AWS docs · Azure docs · IBM Cloud docs · Changelog