CRACI vs Depot

The short answer

Depot is build acceleration: GitHub Actions runners, a remote Docker build service with a persistent layer cache, a remote cache for tools like Bazel and Gradle, and its own CI engine. CRACI is a GitHub Actions-compatible runner built around supply-chain security. Every job produces an SBOM of what it actually fetched, runs under an egress policy you define, and produces signed provenance for its artifacts.

The one-line difference: Depot optimizes how fast your build runs, and CRACI records and controls what goes into it. Both replace the GitHub-hosted runner, so you choose one.

At a glance

What Depot does well

Depot has built a broad, well-documented runner and build platform. Highlights from its own docs:

• A wide runner catalog. Linux runners on AMD EPYC (Intel labels) and AWS Graviton4 (Arm) from 2 vCPUs and 8 GB of RAM up to 64 vCPUs and 256 GB, plus Windows Server 2022 and 2025, and macOS runners on the Startup and Business plans.
• Caching. Runners are wired into Depot's distributed cache, which Depot says reaches upload and download speeds up to 1000 MiB/s. Depot describes its runners as "up to 3x faster than a GitHub-hosted runner" with "10x faster caching".
• Docker builds. depot build is a drop-in replacement for docker build that runs on a remote BuildKit host with a persistent NVMe layer cache shared across your team, and builds x86 and Arm images natively without QEMU emulation. Depot says this is up to 40x faster than building locally or on a CI provider.
• Isolation. Each GitHub Actions job runs on a fresh, single-tenant EC2 instance that is never reused.
• Egress filtering. Allow and deny rules for IPs, CIDRs and hostnames, with a default rule you set to allow or deny. It currently applies to Linux runners.
• Enterprise options. On the Business plan, Depot Managed deploys the data plane into your own AWS account, with AWS PrivateLink, static outbound IPs, and SSO. Depot lists a SOC 2 Type II report.

If Docker image build time is your main CI bottleneck, Depot is built for exactly that problem.

Where CRACI is different

CRACI treats the build as the source of truth for what you ship. The runner is where that evidence is gathered.

A record of what the build fetched

While each job runs, a package-aware proxy records traffic to package sources: npm, PyPI, RubyGems, Cargo, Go, Nix and OCI, plus OS packages and source or download presets. Dependency evidence travels with CI caches, so a package restored from a cache is still counted. Each job's SBOM, in CycloneDX or SPDX, carries a completeness state per job and per cache, so you know when the record is complete and when it is not.

Depot can also produce an SBOM: add --sbom=true to depot build and it generates an SPDX SBOM with Syft. That is a scan of the image the build produced. CRACI's record covers the whole job, including build tools and packages that never end up in an image, and jobs that do not build images at all.

Egress policy built for software sources

Both products let you block unexpected outbound traffic from a runner. CRACI policies are default deny or default allow, with 24 built-in software-source presets, typed custom sources for npm, PyPI, apt, apk, the Go proxy, Nix, Cargo, OCI registries and Git over HTTPS and SSH, and explicit TLS, TCP, UDP and ICMP rules. Policies are validated before the job starts, fail closed, and send an email alert on a violation. Depot's rules work at the level of IPs, CIDRs and hostnames, which is simpler to reason about if that is all you need.

Provenance and monitoring

• Signed provenance links each artifact, including OCI artifacts, to the build that produced it, using Ed25519 over SHA-512. The API traces an artifact to its build, SBOM and network trace. CRACI does not claim a SLSA level. Depot image builds can attach BuildKit provenance attestations, set with the --provenance flag.
• Monitoring of what shipped. Monitored SBOMs are re-evaluated continuously against new vulnerabilities, and findings are aggregated across builds and repositories.

Price and sizes

As of September 2026, Depot charges $0.006 per minute for its 2 vCPU, 8 GB Linux runner beyond the minutes included in your plan, and larger sizes scale linearly: 32 vCPUs cost $0.096 per minute. The Developer plan is $20 per month with 2,000 GitHub Actions minutes, and the Startup plan is $200 per month with 20,000. Depot tracks usage by the second with no one-minute minimum per run, and offers a 7-day free trial.

CRACI bills €0.002 per vCPU-minute, so 2 vCPUs cost €0.004 per minute and 32 vCPUs cost €0.064 per minute, with ARM64 at the same rate. Metering is per second. The Pro plan is €30 per month until end of 2026 and includes 10,000 build minutes. Two things to match before comparing: currencies differ, and memory differs. A CRACI compute unit has 3 GB of RAM per vCPU, while Depot's runners have 4 GB per vCPU. See CRACI pricing for current terms.

Which one fits

Depot is the better fit when

• Docker image builds dominate your CI time.
• You need Windows or macOS runners. CRACI is Linux only.
• You need runners inside your own AWS account. CRACI does not offer customer-hosted runners.
• You rely on remote caching for Bazel, Gradle, Turborepo or sccache.
• Your procurement requires a SOC 2 Type II report today.

CRACI is the better fit when

• You need to show what went into a release, from the build itself, with a completeness state.
• You want build egress controlled by package source, validated before each job.
• You want signed provenance and monitoring of shipped SBOMs in one place.
• You need EU data residency, available on CRACI's Enterprise plan.

For the Cyber Resilience Act

The Cyber Resilience Act asks manufacturers to know the components in their products, handle vulnerabilities in them, and keep evidence. Depot's product is build infrastructure, and its docs focus on speed, caching and isolation. CRACI automates a significant part of the software supply chain visibility and evidence that companies need for their wider CRA compliance process: build-time SBOMs, vulnerability tracking, provenance, and reports you can export.

Switching from Depot to CRACI

Install the CRACI GitHub App on your organization, with access to all repositories or a selected set, then change the runner label on a job:

runs-on: craci

Your workflows and the GitHub UI stay the same. Move one job at a time, starting with a job that builds something you ship. Look at its SBOM and network trace, then write an egress policy that allows the sources it needs. Read more about CI/CD integration and build-time SBOM generation.