CRACI vs Avrea

The short answer

Avrea is a hosted runner service for GitHub Actions, from Helsinki like CRACI, built for speed and for seeing inside your CI: Linux, Windows and macOS runners, automatic dependency caching, log search, runtime metrics, flaky test detection and SSH into running jobs. If your goal is faster pipelines and understanding why they are slow, Avrea's observability goes further than CRACI's, and it covers Windows and macOS today.

CRACI is CI that handles supply chain security natively. Avrea has added security features too: an egress firewall on its Enterprise plan and, in preview, a repository SBOM. The difference is where the evidence comes from. CRACI records every external dependency the build actually fetched, enforces an egress policy that fails closed, and keeps monitoring what shipped for new vulnerabilities. Both products replace the runner your jobs run on, so you choose one.

At a glance

What Avrea does well

CI observability. Avrea collects CPU, memory and network metrics for every job without an agent, searches logs across all jobs and repositories, separates flaky tests from real failures, and shows cache hit rates, slow workflows and spend over time. SSH into a running job works from the terminal or the web console, with a grace period after the job ends. All of it is included on every plan.

Speed and caching. Avrea's runners run on dedicated hardware with high clock speeds and local NVMe storage, and dependencies are cached automatically, close to the runners, after the first build. Avrea says its runners are three times faster, and more with a warm cache. These are Avrea's figures; your own pipeline is the real test.

Platform coverage. Avrea offers Ubuntu on x86-64 from 1 to 32 vCPU, Linux ARM64 and macOS 26 on Apple M5 Max hardware, and Windows 2025. CRACI is Linux only today, with Windows and macOS on the roadmap. Avrea says it supports GitHub Actions today and plans to add other platforms such as GitLab; on CRACI, GitLab CI and Jenkins are on the roadmap.

Security of the service, and an egress firewall. Jobs run in ephemeral VMs, caches are isolated per repository and encrypted, and Avrea is ISO 27001:2022 certified and SOC 2 Type 2 attested. Its egress firewall, listed on the Enterprise plan, allows or denies destinations by domain, CIDR, protocol and port, is enforced on both IP and DNS, and gives each run a summary of where it connected and what was blocked.

Price and sizing

On x86-64, the list price is the same, $0.004 per 2 vCPU minute and $0.064 at 32 vCPU, and Avrea's runners have more memory: 4 GB per vCPU against CRACI's 3 GB. On ARM64 the picture reverses. Avrea's ARM64 runners run on Apple M5 Max hardware at $0.012 per 2 vCPU minute, three times CRACI's ARM64 rate: CRACI charges the same $0.004 as on x86-64. CRACI meters per second, rounded to the nearest second, while Avrea meters per minute, so short jobs are billed for the seconds they run on CRACI. See CRACI pricing for current terms.

Where CRACI is different

An SBOM of what the build fetched, not what the repository declares

Avrea's SBOM reads the dependency manifests and lockfiles on the default branch, without running the code, and lists production dependencies. That is a useful inventory of what the repository declares. CRACI's comes from the build itself: while each job runs, a package-aware proxy records traffic to package sources, npm, PyPI, RubyGems, Cargo, Go, Nix, OCI, apt, apk and Git sources, plus download presets. It includes packages restored from caches and the hidden dependencies no lockfile lists, such as code downloaded by install hooks or build scripts, and base image layers. Every job produces a CycloneDX or SPDX SBOM with a completeness state.

That matters because builds are not reproducible by default: the same commit built twice can pull in different packages. Only an SBOM taken from the build that produced the release shows what is in it.

Egress policy, compared fairly

Both products can hold a build to an allow list and deny everything else. Avrea is ahead in visibility: its per-run summary names the top destinations, the bytes sent and the DNS lookups it refused. CRACI's policy types its sources by package ecosystem and protocol, with 24 built-in software-source presets and custom sources for npm, PyPI, apt, apk, the Go proxy, Nix, Cargo, OCI registries and Git over HTTPS and SSH, is validated before the job starts, fails closed, and sends an alert on a violation. And the same job that runs under the policy also produces the record of the packages it fetched.

Provenance and monitoring

The API returns SBOMs, network traces and provenance. CRACI aggregates vulnerabilities across builds and repositories, keeps re-evaluating monitored SBOMs, and shows which past builds contained a vulnerable dependency.

Book a demo to see the SBOM, network trace and provenance from one of your own workflows.

Which one fits

Avrea is the better fit when

• Faster pipelines and insight into slow jobs, flaky tests and cache behavior are the main goals.
• You need macOS or Windows runners today.
• You want 3,000 free minutes a month; on x86-64 the two list the same per-minute price.
• You need SOC 2 from your runner vendor.

CRACI is the better fit when

• You ship software where you must show what went into each release, from the build itself.
• You want an egress policy typed by package source, validated before the job starts and failing closed.
• You need monitoring of what shipped for new vulnerabilities.
• Your builds run on ARM64, where CRACI's rate is a third of Avrea's.

What you give up with CRACI. Avrea's CI analytics and debugging tooling, Windows and macOS runners, which are on CRACI's roadmap, and 3,000 free minutes a month. What you gain is a build record that security and compliance can use without another scanner in the pipeline.

For the Cyber Resilience Act

The EU Cyber Resilience Act expects manufacturers to know what is in each release and to handle its vulnerabilities, with reporting obligations from September 2026 and full application from December 2027. A dependency inventory from the repository is a start. CRACI produces the SBOM from the build that made the release, monitors it for new vulnerabilities, and exports it as CycloneDX or SPDX, including vulnerabilities. It automates a significant part of the software supply chain visibility and evidence that companies need for their wider CRA compliance process.

Moving from Avrea

CRACI replaces the runner, not GitHub Actions. Workflows and the GitHub UI stay the same, and the job label becomes runs-on: craci. Jobs get Docker Engine, Buildx and Compose v2, a GitHub-compatible Ubuntu 24.04 image, and nested virtualization on x86-64. Read more about CI/CD integration and build-time SBOM generation. Startups can apply for the startup program.

Avrea vs CRACI: common questions

Pricing, speed, SBOMs and egress control, answered from each vendor's published information

What is Avrea?

Avrea is a hosted runner service for GitHub Actions, built in Helsinki by Hannu Valtonen, a co-founder of Aiven, and Juha Valvanne, a co-founder of Nosto. You change the runner label and your jobs run on Avrea's ephemeral VMs with automatic caching, log search, runtime metrics and SSH debugging. Avrea launched in May 2026 with $4.7 million in pre-seed funding led by Earlybird.

How much does Avrea cost?

As of September 2026, Avrea charges per runner minute with no monthly fee: $0.004 per minute for a 2 vCPU x86-64 runner, $0.012 for 2 vCPU ARM64 on Apple M5 Max, $0.008 for 2 vCPU Windows and $0.08 for 8 vCPU macOS. Every organization gets 3,000 free 2 vCPU minutes a month. Static IPs cost $100 per IP per month, and the egress firewall is listed on the Enterprise plan.

Is Avrea cheaper than CRACI?

It depends on the architecture. On 2 vCPU x86-64, both list $0.004 per minute, and Avrea's runner comes with more memory. On 2 vCPU ARM64, CRACI is cheaper: the same $0.004 against Avrea's $0.012, a third of the price. CRACI meters per second and Avrea per minute, so short jobs cost relatively less on CRACI. Avrea also includes 3,000 free minutes a month; CRACI has no free tier but runs a startup program.

Is Avrea faster than CRACI?

Avrea says its runners are three times faster, and more with its cache. CRACI runs builds about twice as fast as GitHub-hosted runners, thanks to faster hardware, shorter queue times and caching. We have not benchmarked the two against each other, so run the same workflow on both and compare.

Avrea has SBOMs now. How is CRACI's different?

Avrea generates a repository SBOM by statically analyzing the dependency manifests and lockfiles on the default branch, with production dependencies only, in CycloneDX and SPDX. It describes what the repository declares. CRACI records what the build actually fetched while it ran, including packages restored from caches and hidden dependencies no lockfile lists, such as code downloaded by install hooks or build scripts and base image layers. Each CRACI SBOM carries a completeness state, and monitored SBOMs are re-evaluated as new vulnerabilities appear.

Both have an egress firewall. What is the difference?

Both let a build reach only the destinations you allow, and both can deny by default. Avrea's rules match domains, CIDRs, protocols and ports, are enforced on both IP and DNS, and come with a per-run summary of where each build connected; it is listed on the Enterprise plan. CRACI's policy types its sources by package ecosystem, with 24 built-in software-source presets, is validated before the job starts and fails closed. CRACI also records which packages and versions came through those connections.

Does CRACI support Windows or macOS runners?

Not yet. CRACI runs Linux on x86-64 and ARM64 today, with Windows and macOS on the roadmap. Avrea offers Windows 2025 and macOS 26 on Apple M5 Max.

Do I have to rewrite my GitHub Actions workflows to switch?

No. Both products replace the runner, not GitHub Actions. Workflows, triggers and the GitHub UI stay the same; on CRACI the job label becomes runs-on: craci.