GitHub-hosted runners and 7 alternatives

What are GitHub-hosted runners?

GitHub-hosted runners are the virtual machines GitHub provides to run your GitHub Actions jobs. Each job gets a new VM in Microsoft Azure with Ubuntu, Windows or macOS and a preinstalled tool set, and you pick one with a label such as runs-on: ubuntu-latest.

GitHub maintains the images in the actions/runner-images repository and updates their software weekly. It supports at most two generally available images and one beta image at a time, and starts retiring the oldest label once a new one reaches general availability. Linux and macOS runners give you passwordless sudo.

Specs and prices of standard runners

In private repositories a standard Linux runner has 2 vCPU, 8 GB of RAM and a 14 GB SSD, for $0.006 per minute on x64. Public repositories get 4 vCPU and 16 GB of RAM on Linux and Windows, free.

Limits to plan around

• Billing: each job is rounded up to the whole minute. Plans include 2,000 minutes on Free, 3,000 on Pro and Team, and 50,000 on Enterprise Cloud.
• Job length: up to 6 hours per job; ubuntu-slim stops jobs after 15 minutes.
• Concurrency: 20 concurrent jobs on Free, 40 on Pro, 60 on Team and 500 on Enterprise, with macOS capped at 5 on Free, Pro and Team.
• Larger runners: up to 96 cores on Linux x64, with static IPs and Azure private networking, on Team and Enterprise Cloud plans. They cost $0.012 per minute and up and never use included minutes.
• Evidence: the runner does not record which packages a job fetched. GitHub's dependency graph describes the repository, not a specific build.

GitHub Actions cost: what a minute costs and how to cut it

Why teams look for alternatives

Teams replace GitHub-hosted runners when the bill, the capacity, network control or release evidence stops fitting. For many teams the defaults are enough: there is nothing to operate, all three operating systems are available, and standard runners are free in public repositories.

We build CRACI, so weigh that in; we describe every option from its own documentation and say when another tool fits better. Teams look elsewhere when their situation changes:

• Volume. As of September 2026, GitHub lists a standard 2-core Linux x64 runner at $0.006 per minute and rounds each job up to the whole minute. Many short jobs make that rounding add up.
• Capacity and caching. Builds outgrow the default shape, or spend their time restoring caches.
• Network control. You want to limit what a build can reach, not only what it runs.
• Evidence. A customer or regulation asks what went into a release, and a general-purpose runner does not record that.
• Location. Some jobs must run inside your own network or cloud account.

What to look for

• Price per vCPU-minute, memory per vCPU, and how usage is rounded.
• Operating systems and architectures you need, including ARM64.
• Dependency and Docker layer caching.
• Egress control, and whether it is a policy on the job or network plumbing you maintain.
• Build evidence: SBOMs, provenance and a record of what each job fetched.
• Where runners live, and the build evidence your procurement asks for.

Where a vendor below publishes a speed claim, we quote it as that vendor's figure. Your own pipeline is the only fair benchmark.

The options

CRACI (our product)

CRACI is a GitHub Actions-compatible runner built around supply chain security. Install the CRACI GitHub App and set runs-on: craci. Billing is $0.002 per vCPU-minute ($0.004 for 2 vCPU), metered per second, with ARM64 at the same rate (ARM64 capacity is limited). Sizes run from 1 to 32 compute units of 1 vCPU and 3 GB of RAM. Each job produces an SBOM of what it fetched, with a completeness state, and runs under an egress policy that fails closed.

Best for: Linux builds of software you ship, where you need to show what went into each release.

Consider if: evidence and egress control matter as much as cost. CRACI is Linux only today (Windows and macOS are on the roadmap) and has no free tier. CRACI runs builds about twice as fast as GitHub-hosted runners, thanks to faster hardware, shorter queue times and caching.

CRACI vs GitHub-hosted runners

Blacksmith

Blacksmith runs GitHub Actions jobs in Firecracker microVMs, with Ubuntu on x64 and ARM from 2 to 32 vCPU, Windows in public beta, and macOS on Apple M4. It says its runners are twice as fast as GitHub-hosted runners. A colocated cache works with the standard cache actions, and sticky disks provide Docker layer caching at $0.50 per GB per month. As of September 2026, 2 vCPU x64 costs $0.004 per minute and ARM $0.0025, with 3,000 free minutes a month.

Best for: faster, cheaper Actions with Docker caching and SSH debugging.

Consider if: speed and cost are the goal.

CRACI vs Blacksmith

Depot

Depot offers Linux runners from 2 to 64 vCPUs, Windows, and macOS on the Startup plan and above, wired into a distributed cache. It describes its runners as "up to 3x faster than a GitHub-hosted runner." Its remote Docker build service keeps a persistent layer cache, Linux runners support egress filtering, and on the Business plan runners can live in your own AWS account. As of September 2026, 2 vCPU costs $0.006 per minute beyond plan minutes, tracked per second.

Best for: teams whose CI time is dominated by Docker image builds.

Consider if: you want remote build caching for Bazel, Gradle or Turborepo too.

CRACI vs Depot

Namespace

Namespace runs Linux, Windows and macOS runners on hardware it operates itself, selected through runner profiles. Cache volumes keep data on local storage across runs. Its egress policies run in block mode or in advisory mode, which records decisions without blocking so you can build an allowlist from real traffic. As of September 2026, a 2 vCPU, 4 GB Linux runner costs $0.002 per minute in plan and $0.003 in overage.

Best for: Linux, Windows and macOS runners from one vendor, with cache volumes.

Consider if: you want to trial an egress policy before enforcing it.

CRACI vs Namespace

WarpBuild

WarpBuild offers Linux runners on x86-64 and arm64 up to 32 vCPUs, Windows Server, and macOS on Apple M4 Pro, with container-layer caching and snapshot runners. Its bring-your-own-cloud option runs the same runners in your AWS, GCP or Azure account at $0.002 per minute plus your cloud bill. Hosted 2 vCPU x86-64 costs $0.004 per minute (as of September 2026). WarpBuild advertises builds two to ten times faster.

Best for: managed runners inside your own cloud account.

Consider if: you need GitHub Enterprise Server support or a 99.9% uptime SLA.

CRACI vs WarpBuild

We also compare CRACI one to one with RunsOn, which runs runners in your own AWS account, Ubicloud and Avrea.

Self-hosted runners with Actions Runner Controller

Actions Runner Controller (ARC) is "a Kubernetes operator that orchestrates and scales self-hosted runners for GitHub Actions." Runner scale sets grow and shrink with the number of workflows running, and runners can be ephemeral containers. GitHub does not charge per minute for self-hosted usage as of September 2026, but you are responsible for the operating system and software, and GitHub warns that self-hosted runners should almost never be used for public repositories.

Best for: jobs that must run in your network or on your hardware.

Consider if: you already run Kubernetes and have the time to harden and maintain it.

Managed vs self-hosted runners

Add-on: StepSecurity Harden-Runner

If you want to keep GitHub-hosted runners, Harden-Runner adds security to them instead of replacing them. It is an agent added as the first step of a job. It maps outbound connections, processes and file writes to each workflow step, builds a baseline in audit mode, and blocks egress to anything off an allowlist. It fully supports GitHub-hosted Linux runners and runs in audit mode on Windows and macOS. The Community tier is free for public repositories; Enterprise is $16 per contributing developer per month (as of September 2026).

Best for: egress control and runtime visibility without changing runners.

CRACI vs StepSecurity

Side by side

"Not stated" means we could not confirm it in the vendor's public pages.

When to stay on GitHub-hosted runners

• Your usage fits inside your plan's included minutes, or your repositories are public.
• You want zero setup and no extra vendor.
• You need a documented SLSA level: GitHub states its artifact attestations provide SLSA v1.0 Build Level 2, and Level 3 with reusable workflows.
• You can mix: the choice is per job, so macOS and Windows jobs can stay while Linux jobs move.

Read more about CI/CD integration, CRACI pricing and the startup program, or book a demo to see one of your own workflows on CRACI.

GitHub-hosted runners FAQ

Specs, prices, limits and the alternatives, in short answers.

What are GitHub-hosted runners?

They are the machines GitHub provides to run GitHub Actions jobs. Each job gets a new virtual machine hosted by GitHub in Microsoft Azure, with Ubuntu, Windows or macOS and a preinstalled tool set from the actions/runner-images repository. You select one with a label such as runs-on: ubuntu-latest.

What are the specs of ubuntu-latest?

In private repositories, ubuntu-latest is Ubuntu 24.04 on 2 x64 vCPU with 8 GB of RAM and a 14 GB SSD. In public repositories the same label gets 4 vCPU and 16 GB of RAM.

How much do GitHub-hosted runners cost?

As of September 2026, the standard 2-core Linux x64 runner is $0.006 per minute, arm64 is $0.005, Windows is $0.010 and macOS is $0.062. Plans include 2,000 to 50,000 minutes a month for standard runners, and standard runners are free in public repositories. GitHub rounds each job up to the whole minute.

How long can a job run on a GitHub-hosted runner?

Up to 6 hours per job. The ubuntu-slim single-CPU runner stops jobs after 15 minutes. Concurrency is capped by plan: 20 concurrent jobs on Free, 40 on Pro, 60 on Team and 500 on Enterprise.

What are larger runners?

Larger runners are GitHub-hosted runners with more CPU, RAM and disk, up to 96 cores on Linux x64, with options such as static IP addresses, Azure private networking and GPUs. They need a Team or Enterprise Cloud plan, are billed per minute from $0.012 for 4 cores, and never use included minutes.

Should I use GitHub-hosted or self-hosted runners?

GitHub-hosted runners need no upkeep and suit most teams whose usage fits the included minutes. Self-hosted runners have no per-minute GitHub charge today, but you run, patch and secure the machines, and GitHub warns against using them on public repositories. A managed runner such as CRACI sits between the two: nothing to operate, a lower list price on standard Linux runners, and build evidence on every job.

Can I switch runners without changing my workflows?

Yes. Every managed alternative on this page keeps your workflows on GitHub Actions and changes only the runs-on label, per job. On CRACI you install the GitHub App and set runs-on: craci.

Does CRACI have a free tier?

No. You pay per build minute from the first minute, $0.004 on a 2 vCPU runner, metered per second, with no monthly fee and no per-SBOM charge. The startup program gives at least 100,000 free build minutes and hands-on onboarding.