CRACI vs Blacksmith CI

The short answer

Blacksmith is a managed runner service for GitHub Actions, built for speed and cost: Linux, Windows and macOS runners on bare-metal hardware, a colocated dependency cache, Docker layer caching on persistent disks, and CI observability. If your only goal is faster, cheaper GitHub Actions, Blacksmith is a strong option: its x64 list price is the same as CRACI's, its ARM price is lower, and it includes 3,000 free x64 minutes a month.

CRACI is CI that handles supply chain security natively. It is also a GitHub Actions-compatible runner, and switching is the same kind of one-line change, but the security is part of the runner rather than a tool added to it. CRACI records every external dependency the build fetched, enforces an egress policy on the build network, and turns that record into SBOMs, vulnerability monitoring and CRA evidence. Both products compete for the same runner budget, so you choose one.

At a glance

What Blacksmith does well

Performance focus. Blacksmith runs jobs on bare-metal machines with high single-core performance, says its runners are twice as fast as GitHub-hosted runners, and says its colocated cache downloads about four times faster. For Docker builds, it reports that customers have seen 2x to 40x improvements from layer caching. These are Blacksmith's figures; your own pipeline is the real test.

Caching without workflow changes. GitHub's official cache and setup actions talk to Blacksmith's cache transparently, with 25 GB of free storage per repository per week and least recently used eviction after seven days. Sticky disks and Docker layer caching persist state across runs for $0.50 per GB per month, and the docs also cover Bazel, Git checkout and container image caching.

Platform coverage. Blacksmith offers Ubuntu 22.04 and 24.04 on x64 and ARM from 2 to 32 vCPU, Windows Server 2025 in public beta, and macOS on Apple M4 in 6 and 12 vCPU sizes. It sets no concurrency limits. CRACI is Linux only today, with Windows and macOS on the roadmap, so for those jobs Blacksmith covers ground CRACI does not yet.

Debugging and analytics. SSH access into running jobs, run history, log search, metrics, monitors, test analytics and a CI dashboard are all documented features. Testboxes, which run local changes inside a real GitHub Actions job, are in early beta.

Security and compliance of the service. Jobs run in ephemeral Firecracker microVMs, and each job gets a just-in-time token scoped to that job that expires after one hour. Blacksmith states it is SOC 2 Type 2 and GDPR compliant, and pentested every quarter.

Price and sizing

On x64 the two have the same list price, $0.004 per 2 vCPU minute. Blacksmith's ARM price is clearly lower, since CRACI charges ARM64 at the same rate as x86-64, and Blacksmith includes 3,000 free x64 minutes a month. CRACI meters per second, rounded to the nearest second, so short jobs are billed for the seconds they run. Shapes differ too: a CRACI compute unit is 1 vCPU with 3 GB of RAM, from 1 to 32 units, while Blacksmith's x64 runners have 4 GB per vCPU and its ARM runners 3 GB. Match the memory your builds need before comparing prices. See CRACI pricing for current terms.

Speed is not where the two differ most. Both say their runners are about twice as fast as GitHub-hosted runners. CRACI gets there with faster hardware, shorter queue times and caching. We have not benchmarked the two against each other.

Where CRACI is different

A record of what the build fetched

While each job runs, a package-aware proxy records traffic to package sources: npm, PyPI, RubyGems, Cargo, Go, Nix, OCI, apt, apk and Git sources, plus download presets. Dependency evidence travels with CI caches, so packages restored from a cache are still counted. Every job produces a CycloneDX or SPDX SBOM with a completeness state per job and per cache: Complete, Complete with connections, Incomplete, Unavailable or Not recorded.

Control over what the build can reach

Blacksmith's static IPs give your runners a fixed address for reaching firewalled services. CRACI also provides a stable egress IP range, and adds egress policies: default deny or default allow, 24 built-in software-source presets, typed custom sources, and explicit TLS, TCP, UDP and ICMP rules. Policies are validated before the job starts, fail closed, and send an alert on a violation.

Provenance and monitoring

The API returns SBOMs, network traces and provenance. CRACI aggregates vulnerabilities across builds and repositories and keeps re-evaluating monitored SBOMs.

Two different security questions

Blacksmith's security work answers "is the runner service safe to trust with my jobs?": isolated microVMs, short-lived tokens, encrypted caches and a SOC 2 report. CRACI answers that question too, with isolated virtual machines and no stored source code, and then a second one: "what did this build pull in, and where did it connect?" That second answer is what an auditor, a customer or the Cyber Resilience Act asks you for.

Book a demo to see the SBOM, network trace and provenance from one of your own workflows.

Which one fits

Blacksmith is the better fit when

• Build speed and the lowest cost per minute on ARM are the main goals, or the free monthly minutes matter.
• You need macOS or Windows runners today.
• You rely on sticky disks, Blacksmith's observability console or SSH debugging.

CRACI is the better fit when

• You ship software where you must show what went into each release, from the build itself.
• You want to restrict what builds can reach, with a policy that fails closed.
• You need monitoring of what shipped, without adding tools to every workflow.
• You need EU data residency, available on CRACI's Enterprise plan.

What you give up with CRACI. Windows and macOS jobs, which are on the roadmap, the lowest ARM price, and Blacksmith's debugging and analytics tooling. What you gain is a build record that security and compliance can use without another scanner in the pipeline.

For the Cyber Resilience Act

The EU Cyber Resilience Act expects manufacturers to know what is in each release and to handle its vulnerabilities, with reporting obligations from September 2026 and full application from December 2027. A fast runner does not produce that evidence by itself; you would add SBOM and scanning tools to your workflows. CRACI produces it from the build record and exports SBOMs as CycloneDX or SPDX, including vulnerabilities. It automates a significant part of the software supply chain visibility and evidence that companies need for their wider CRA compliance process.

Moving from Blacksmith

CRACI replaces the runner, not GitHub Actions. Workflows and the GitHub UI stay the same, and the job label becomes runs-on: craci. Jobs get Docker Engine, Buildx and Compose v2, a GitHub-compatible Ubuntu 24.04 image, and nested virtualization on x86-64. Read more about CI/CD integration and build-time SBOM generation. Startups can apply for the startup program.

Blacksmith vs CRACI: common questions

Pricing, speed, platforms and security, answered from each vendor's published information

What is Blacksmith CI?

Blacksmith is a managed runner service for GitHub Actions. You keep your workflows and change the runner label, and your jobs run on Blacksmith's bare-metal machines in Firecracker microVMs instead of on GitHub-hosted runners. It sells on speed and price: faster hardware, a colocated dependency cache, Docker layer caching and CI observability.

How much does Blacksmith cost?

As of September 2026, Blacksmith lists 2 vCPU Ubuntu x64 at $0.004 per minute, Ubuntu ARM at $0.0025, Windows at $0.008 and macOS M4 (6 vCPU) at $0.08. Every organization gets 3,000 free 2 vCPU x64 minutes a month. Docker layer caching and sticky disks cost $0.50 per GB per month, and static IPs $100 per IP per month.

Is Blacksmith cheaper than CRACI?

On ARM, yes; on x64 the list price is the same. CRACI charges $0.004 per minute for 2 vCPU on both x86-64 and ARM64, against Blacksmith's $0.004 on x64 and $0.0025 on ARM, and Blacksmith includes 3,000 free x64 minutes a month. CRACI meters per second, so short jobs are billed for the seconds they run. What CRACI adds on the runner is the build record: an SBOM for every job, an egress policy, provenance data through the API and vulnerability monitoring, which would otherwise take separate tools.

Is Blacksmith faster than CRACI?

Both say their runners are about twice as fast as GitHub-hosted runners. CRACI gets there with faster hardware, shorter queue times and caching. We have not benchmarked the two against each other, so run the same workflow on both and compare.

Does Blacksmith generate SBOMs or build provenance?

Not among its documented features. Blacksmith focuses on compute, caching and observability. CRACI records the packages every job fetches, including packages restored from caches, and produces a CycloneDX or SPDX SBOM with a completeness state. The API returns SBOMs, network traces and provenance.

Can Blacksmith restrict what a build can reach on the network?

Blacksmith offers static IPs so your jobs can reach firewalled services from a fixed address. A policy on what the job itself may connect to is not among its documented features. CRACI enforces an egress policy at the runner: default deny or allow, 24 built-in software-source presets, validated before the job starts and failing closed.

Does CRACI support Windows or macOS runners?

Not yet. CRACI runs Linux on x86-64 and ARM64 today, with Windows and macOS on the roadmap. Blacksmith offers macOS on Apple M4 and Windows Server 2025 in public beta.

Where do the jobs run, and can data stay in the EU?

Blacksmith runs jobs on bare-metal machines in US East, US West, Amsterdam and Frankfurt, with its control plane on AWS. CRACI runs builds on European bare-metal infrastructure, with EU data residency on the Enterprise plan. CRACI does not store your source code; it is processed in the job VM for the duration of the build.

Is Blacksmith SOC 2 compliant?

Blacksmith states it is SOC 2 Type 2 and GDPR compliant and is pentested every quarter. CRACI documents its security controls in its Trust Center.

Do I have to rewrite my GitHub Actions workflows to switch?

No. Both products replace the runner, not GitHub Actions. Workflows, triggers and the GitHub UI stay the same; on CRACI the job label becomes runs-on: craci.