CRACI vs Blacksmith | Fast Runners vs Secure CI Compared

The short answer

Blacksmith is a managed runner service for GitHub Actions. It is built for speed and cost: Linux, Windows and macOS runners, a colocated dependency cache, Docker layer caching on persistent disks, and CI observability. If your goal is faster, cheaper GitHub Actions and nothing else, Blacksmith is a strong option.

CRACI is CI that handles supply chain security natively. It is also a GitHub Actions-compatible runner, and switching is the same kind of one-line change, but the security is part of the runner rather than a tool added to it. CRACI records every external dependency the build fetched, enforces an egress policy on the build network, signs provenance for the artifacts, and turns that record into SBOMs, vulnerability monitoring and CRA evidence. Both products compete for the same runner budget, and you would normally pick one per job.

Capability	CRACI	Blacksmith
Setup	Install the CRACI GitHub App, then set runs-on: craci.	Install the Blacksmith GitHub App, then swap labels such as blacksmith-2vcpu-ubuntu-2404.
Build-time SBOM from observed dependencies	Every job, with completeness state, cached packages included	Not among its documented features
Build network egress policy	Default deny or allow, fails closed	Static IPs for allowlisting, $100 per IP per month
Signed build provenance	Ed25519 over SHA-512; no SLSA level claimed	Not among its documented features
Vulnerability monitoring	Monitored SBOMs re-evaluated	Not among its documented features
Operating systems	Linux only, on x86-64 and ARM64	Linux x64 and ARM, Windows (beta), macOS M4
Price, 2 vCPU Linux	€0.004 per minute on x86-64 and on ARM64 (€0.002 per vCPU-minute), metered per second.	$0.004 per minute on x64 and $0.0025 per minute on ARM (as of September 2026).
Included usage	Pro is €30 per month until end of 2026 and includes 10,000 build minutes.	3,000 free 2 vCPU x64 minutes per month per organization.
Dependency caching	GitHub Actions cache	Colocated cache, 25 GB per repository per week
Docker layer caching	Local, remote and bind mount layer caches	Sticky disks at $0.50 per GB per month
Where jobs run	Isolated VMs; EU data residency on Enterprise, on European bare-metal infrastructure.	Firecracker microVMs in US East, US West, Amsterdam and Frankfurt regions.
SOC 2 Type 2 report	Policies and controls published in the Trust Center	SOC 2 Type 2, pentested quarterly

Included
Partly
Not included

What Blacksmith does well

Performance focus. Blacksmith says its runners are twice as fast as GitHub-hosted runners and that its colocated cache downloads about four times faster. For Docker builds, it reports that customers have seen 2x to 40x improvements from layer caching. These are Blacksmith's figures; your own pipeline is the real test.

Caching without workflow changes. Official GitHub and popular third-party cache actions talk to Blacksmith's cache transparently, with 25 GB of free storage per repository per week. Sticky disks and Docker layer caching persist state across runs for $0.50 per GB per month.

Platform coverage. Blacksmith offers Ubuntu 22.04 and 24.04 on x64 and ARM from 2 to 32 vCPU, Windows Server 2025 in public beta, and macOS on Apple M4. CRACI is Linux only, so for Windows and macOS jobs Blacksmith covers ground CRACI does not.

Debugging and analytics. SSH access into running jobs, run history, metrics, monitors, test analytics and a CI dashboard are all documented features.

Security and compliance of the service. Jobs run in ephemeral Firecracker microVMs with just-in-time tokens scoped to a single job. Blacksmith states it is SOC 2 Type 2 and GDPR compliant, and pentested every quarter.

Price and sizing

As of September 2026, Blacksmith lists 2 vCPU Ubuntu x64 at $0.004 per minute and Ubuntu ARM at $0.0025 per minute, with 3,000 free x64 minutes a month per organization. CRACI bills €0.002 per vCPU-minute, so a 2 vCPU runner is €0.004 per minute on both x86-64 and ARM64, metered per second. The x64 list prices are the same number in different currencies, so compare at your own exchange rate. For ARM, Blacksmith's list price is lower.

Shapes differ too. A CRACI compute unit is 1 vCPU with 3 GB of RAM, from 1 to 32 units, and ARM64 capacity is limited. Blacksmith's 2 vCPU x64 runner has 8 GB of RAM and its ARM runners 3 GB per vCPU. Match the memory your builds need before comparing prices. The CRACI Pro plan is €30 per month until end of 2026 and includes 10,000 build minutes. See CRACI pricing.

Speed is not where the two differ most. Both say their runners are about twice as fast as GitHub-hosted runners. CRACI gets there with faster hardware, shorter queue times and caching. We have not benchmarked the two against each other.

Where CRACI is different

A record of what the build fetched

While each job runs, a package-aware proxy records traffic to package sources: npm, PyPI, RubyGems, Cargo, Go, Nix and OCI, plus OS packages and source or download presets. Dependency evidence travels with CI caches, so packages restored from a cache are still counted. Every job produces a CycloneDX or SPDX SBOM with a completeness state per job and per cache: Complete, Complete with connections, Incomplete, Unavailable or Not recorded.

Control over what the build can reach

Blacksmith's static IPs give your runners a fixed address for reaching firewalled services. CRACI also provides a stable egress IP range, and adds egress policies: default deny or default allow, 24 built-in software-source presets, typed custom sources, and explicit TLS, TCP, UDP and ICMP rules. Policies are validated before the job starts, fail closed, and send an email alert on a violation.

Provenance and monitoring

CRACI signs provenance that links each artifact, including OCI artifacts, to the build that produced it, using Ed25519 over SHA-512. It aggregates vulnerabilities across builds and repositories and keeps re-evaluating monitored SBOMs.

Which one fits

Blacksmith if your priority is build speed and cost, you need Windows or macOS runners, or you rely on its sticky disks today.
CRACI if you ship software where you must show what went into each release, want to restrict what builds can reach, or need SBOMs and provenance tied to the actual build.
A mix works because the choice is per job: Linux release builds on CRACI, macOS and Windows jobs elsewhere.

For the Cyber Resilience Act

The EU Cyber Resilience Act expects manufacturers to know what is in each release and to handle its vulnerabilities, with reporting obligations from September 2026 and full application from December 2027. A fast runner does not produce that evidence by itself; you would add SBOM and scanning tools to your workflows. CRACI produces it from the build record and exports reports in PDF, HTML, CSV, Excel and JSON. It automates a significant part of the software supply chain visibility and evidence that companies need for their wider CRA compliance process.

Switching

Install the CRACI GitHub App on your organization, for all repositories or a selected set, and change the label:

runs-on: craci

Workflows and the GitHub UI stay the same. Jobs get Docker Engine, Buildx and Compose v2, and nested virtualization on x86-64. Read more about CI/CD integration and build-time SBOM generation. Startups can apply for the startup program.