GitHub Actions runners compared

Who this is for

You run GitHub Actions and the runner is up for review. The bill has grown, jobs queue, or a customer asked for an SBOM and provenance for each release. The managed providers on this page all plug in the same way: you connect them to your GitHub organization and change the runs-on label on a job. Workflows, actions and the GitHub UI stay as they are, so you can trial one job at a time.

We build CRACI, so weigh that in. Every other product is described from its own documentation and pricing pages, and we say where another option fits better.

How to choose

• Which operating systems do you need? CRACI is Linux only. GitHub, Blacksmith, Depot, Namespace and WarpBuild also offer Windows and macOS.
• What shape are your jobs? Memory per vCPU ranges from 2 GB to 4 GB across these products, so compare prices at the memory your builds need, not only the vCPU count.
• Many short jobs? Metering then matters as much as list price. GitHub rounds each job up to the whole minute; CRACI and Depot meter by the second.
• Are Docker image builds the bottleneck? Blacksmith, Depot, Namespace and WarpBuild all offer layer caching. On CRACI it is on the roadmap.
• Do you need to show what went into a release? Only CRACI records the packages each job fetched and turns that record into an SBOM with a stated completeness.
• Do you need to control what a build can reach? CRACI, Depot and Namespace attach an egress policy to the runner. StepSecurity adds one to runners you already have.
• Does procurement need a SOC 2 Type II report today? Blacksmith, Depot, Namespace and WarpBuild list one. CRACI does not have one; its Trust Center documents policies and controls.

At a glance

Prices are each vendor's list prices for Linux runners as of September 2026, in the currency the vendor quotes. CRACI prices in euros and the others in US dollars, so convert at your own rate.

The options

GitHub-hosted runners

The default. Each job gets a fresh virtual machine, there is nothing to operate, and Linux, Windows and macOS are available. The standard 2-core Linux x64 runner is $0.006 per minute, arm64 is $0.005, and larger runners go up to 64 cores. Plans include 2,000 to 50,000 minutes a month, and standard runners are free on public repositories. For provenance, GitHub's artifact attestations provide SLSA v1.0 Build Level 2, or Level 3 with reusable workflows. Best for Windows and macOS jobs, public repositories, and usage that fits the included minutes. Watch out for per-job rounding to the whole minute. The dependency graph describes the repository, not a specific build.

CRACI vs GitHub-hosted runners

CRACI

A Linux GitHub Actions runner built around supply chain security. Sizes run from 1 to 32 compute units of 1 vCPU and 3 GB RAM each, on x86-64 and ARM64 at the same rate, though ARM64 capacity is limited. Billing is €0.002 per vCPU-minute, metered per second. While each job runs, a package-aware proxy records what it fetched, including packages restored from CI caches, and produces a CycloneDX or SPDX SBOM with a completeness state per job and per cache. Egress policies are default deny or allow, validated before the job, and fail closed. Artifacts get signed provenance (Ed25519 over SHA-512; no SLSA level claimed). Best for teams that ship software and must show what went into each release. Container layer caching is available: local, remote and bind mount caches. Watch out for Linux only and no customer-hosted runners.

How CRACI runners work

Blacksmith

A managed runner service focused on speed and cost. You install its GitHub App and swap labels. As of September 2026, 2 vCPU Ubuntu x64 is $0.004 per minute and ARM is $0.0025, with 3,000 free x64 minutes a month per organization. It offers Ubuntu on x64 and ARM from 2 to 32 vCPU, Windows in public beta, and macOS on Apple M4, plus a colocated cache and Docker layer caching on sticky disks at $0.50 per GB per month. Blacksmith says its runners are twice as fast as GitHub-hosted runners; that is its figure. Best for faster, cheaper Actions with Docker caching. Watch out for static IPs rather than an egress policy, and no build SBOM or provenance among its documented features.

CRACI vs Blacksmith

Depot

Build acceleration: GitHub Actions runners, a remote Docker build service with a persistent NVMe layer cache, and remote caching for tools like Bazel and Gradle. You connect your organization and change the label, for example to depot-ubuntu-24.04. The 2 vCPU, 8 GB Linux runner is $0.006 per minute beyond plan minutes, Arm at the same rate, up to 64 vCPU. Egress filters allow or deny IPs, CIDRs and hostnames on Linux runners, and depot build can generate an SPDX SBOM of the image with Syft. Depot describes its runners as up to 3x faster than GitHub-hosted. Best for CI dominated by Docker image builds, or runners in your own AWS account. Watch out for an SBOM that describes the image, not the whole job.

CRACI vs Depot

Namespace

Managed runners on hardware Namespace operates, across Linux on AMD64 and ARM64, Windows (Team plan and above) and macOS. You create a runner profile and reference it in runs-on. A 2 vCPU, 4 GB Linux runner is $0.002 per minute within plan minutes and $0.003 in overage; usage has a one-minute minimum per job. Cache volumes keep data on local storage across runs. Its egress policies run in block mode or in advisory mode, which records decisions without blocking so you can build an allowlist from real traffic. Best for low list prices, macOS, and trialing an egress policy before enforcing it. Watch out for 2 GB of RAM per vCPU, and egress logs that show domains rather than packages.

CRACI vs Namespace

WarpBuild

Hosted runners, or the same runners in your own AWS, GCP or Azure account (bring your own cloud, BYOC). You change runs-on to a WarpBuild label such as warp-ubuntu-latest-x64-2x. Linux runs on x86-64 and arm64 from 2 vCPU and 8 GB to 32 vCPU, alongside Windows and macOS on Apple M4 Pro. As of September 2026, 2 vCPU is $0.004 per minute on x86-64 and $0.003 on arm64, billed per minute; BYOC is $0.002 plus your cloud bill. It offers container-layer caching, snapshot runners and remote Docker builders. WarpBuild advertises builds two to ten times faster. Best for runners in your own cloud. Watch out for no documented per-job egress policy on hosted runners.

CRACI vs WarpBuild

The DIY option: self-hosted runners

You can also run your own. Actions Runner Controller (ARC) is a Kubernetes operator that orchestrates and scales self-hosted runners for GitHub Actions, with runner scale sets that grow and shrink with the number of workflows running. As of September 2026, GitHub's billing docs describe self-hosted runner usage as free.

What GitHub does not cover is everything around the runner. Its documentation says that with self-hosted runners "you are responsible for updating the operating system and all other software," and warns that they do not have guarantees around running in ephemeral clean virtual machines. Hosts, patching, isolation and egress control are yours to build and keep running. Self-hosting is the right answer when a job must run inside your network or on hardware you own; CRACI does not offer customer-hosted runners.

Managed vs self-hosted runners: a cost model

Adding egress control to runners you keep

If you want to stay on GitHub-hosted or self-hosted runners, StepSecurity's Harden-Runner adds egress control without changing runners. It is an agent that watches outbound connections, processes and file writes in each job, ties them to the step that caused them, and can block anything not on an allowlist after an audit period. It has full support on GitHub-hosted Linux runners, audit mode on Windows and macOS, and, on the Enterprise tier, self-hosted VMs, bare metal and ARC. As of September 2026, the Community tier is free for public repositories and Enterprise is $16 per contributing developer per month, with runner costs separate. It records destinations, processes and files, not a package-level SBOM.

CRACI vs StepSecurity

How CRACI fits

Most of these products compete on speed, price and platforms, and several do that well. CRACI competes on what the runner records and controls. It is the only option here that turns every job into a record of the packages it fetched, runs it under an egress policy validated before it starts, and signs provenance for what it produced. That record then feeds vulnerability monitoring and report exports in PDF, HTML, CSV, Excel and JSON. It automates a significant part of the software supply chain visibility and evidence that companies need for their wider Cyber Resilience Act compliance process.

CRACI is not the right choice when:

• You need Windows or macOS runners. Keep those jobs elsewhere; the choice is per job.
• Runners must live in your own cloud account or on your hardware.
• Procurement requires a SOC 2 Type II report now.
• The lowest ARM64 price per minute is the goal. Blacksmith and WarpBuild list lower ARM prices.

We do not publish a speed multiplier. Build speed depends on your workload, so the fair test is one of your own jobs. The CRACI Pro plan is €30 per month until end of 2026 and includes 10,000 build minutes. See CRACI pricing for current terms.