CRACI vs Namespace

The short answer

Namespace is developer infrastructure: managed GitHub Actions runners, remote Docker builders, cache volumes, Bazel remote execution and cloud dev environments, all running on hardware Namespace operates itself. CRACI is a GitHub Actions-compatible runner built around supply-chain security. Every job produces an SBOM of what it actually fetched, runs under an egress policy, and produces signed provenance for its artifacts.

Both products can restrict what a build reaches on the network, and Namespace's egress policies are well designed. The difference is what else happens on the runner: Namespace focuses on speed, platforms and caching, and CRACI records the build and carries that record through vulnerability monitoring and CRA evidence. For a single job you choose one runner, but a team can run Linux build jobs on CRACI and macOS jobs on Namespace.

At a glance

What Namespace does well

• Platforms. Linux on AMD64 (AMD EPYC) and ARM64 (AmpereOne, and Apple Silicon in early access), Windows on AMD EPYC, and macOS on Apple M5 Max or M4 Pro. Windows runners come with the Team plan and above.
• Runner profiles. You create a profile in the dashboard with an operating system and a machine shape, then reference it in runs-on. Shapes go up to 64 vCPUs on Linux, and Namespace says support can unlock up to 512 GB of RAM.
• Caching. Cache volumes keep data on local storage across runs, so jobs do not upload and download a cache archive each time. Namespace also offers Docker build caching, Bazel remote cache and execution, and Turborepo and Gradle caches.
• Egress policies. Policies run in BLOCK mode, which denies anything not allowed, or ADVISORY mode, which records the same decisions without blocking so you can build an allowlist from real traffic. Rules match domains, a managed github-actions ruleset keeps runners working, and with deep packet inspection a policy can inject secrets into request headers or route traffic through a proxy. A dashboard groups allowed and denied requests by domain, and each instance has its own egress view.
• Trust. Namespace holds SOC 2 Type II, with the report available in its Trust Center, and offers region-exclusive data residency on enterprise plans.

Namespace publishes customer results such as DuckDB running its CI "10x faster". Those are Namespace's figures for those customers.

Where CRACI is different

CRACI treats the build as the source of truth for what you ship.

A record of what the build fetched

While each job runs, a package-aware proxy records traffic to package sources: npm, PyPI, RubyGems, Cargo, Go, Nix and OCI, plus OS packages and source or download presets. Dependency evidence travels with CI caches, so a package restored from a cache is still counted. Each job's SBOM, in CycloneDX or SPDX, carries a completeness state per job and per cache. Namespace's egress logs tell you which domains a runner contacted. CRACI's record tells you which packages and versions the build pulled from them.

Egress policy, compared fairly

CRACI policies are default deny or default allow, with 24 built-in software-source presets, typed custom sources for npm, PyPI, apt, apk, the Go proxy, Nix, Cargo, OCI registries and Git over HTTPS and SSH, and explicit TLS, TCP, UDP and ICMP rules. Policies are validated before the job starts, fail closed, reject unknown fields, and send an email alert on a violation.

Namespace is ahead in two places. Its advisory mode lets you observe a policy before enforcing it, and CRACI's monitor mode is still on the roadmap. Its secret injection and proxy rules have no CRACI equivalent. Where CRACI differs is that its sources are typed by package ecosystem and protocol rather than listed as domains, and the same job that runs under the policy also produces the record of the packages it fetched.

Provenance and monitoring

• Signed provenance links each artifact, including OCI artifacts, to the build that produced it, using Ed25519 over SHA-512. The API traces an artifact to its build, SBOM and network trace. CRACI does not claim a SLSA level.
• Monitoring of what shipped. Monitored SBOMs are re-evaluated continuously against new vulnerabilities, and findings are aggregated across builds and repositories.

Price and sizes

Namespace bills in unit minutes, where one unit is 1 vCPU and 2 GB of RAM for one minute on Linux. As of September 2026, a 2 vCPU, 4 GB Linux runner costs $0.002 per minute within plan minutes and $0.003 per minute in overage. The Team plan is $100 per month with 100,000 unit minutes, and Business is $250 per month with 250,000. Windows uses minutes at twice the Linux rate and macOS at ten times. Usage has a one-minute minimum per job and is then rounded by minute; Namespace's example bills 150 seconds as 3 minutes.

CRACI bills €0.002 per vCPU-minute, so a 2 vCPU runner with 6 GB of RAM costs €0.004 per minute, with ARM64 at the same rate, metered per second. The Pro plan is €30 per month until end of 2026 and includes 10,000 build minutes. Namespace's standard shapes have 2 GB of RAM per vCPU and CRACI's have 3 GB, and the currencies differ, so match the shape your builds need before comparing. See CRACI pricing for current terms.

Which one fits

Namespace is the better fit when

• You need macOS or Windows runners. CRACI is Linux only.
• You want to trial an egress policy in advisory mode before enforcing it.
• You depend on Bazel remote execution or cache volumes.
• You also run Buildkite agents or cloud dev environments and want one vendor.
• Your procurement requires a SOC 2 Type II report today.

CRACI is the better fit when

• You need to show what went into a release, with a completeness state, from the build itself.
• You want signed provenance, and monitoring of shipped SBOMs in one place.
• You need evidence for the Cyber Resilience Act.
• You need EU data residency, available on CRACI's Enterprise plan.

For the Cyber Resilience Act

The Cyber Resilience Act asks manufacturers to know the components in their products, handle vulnerabilities in them, and keep evidence. Namespace's product is fast CI and development infrastructure. CRACI automates a significant part of the software supply chain visibility and evidence that companies need for their wider CRA compliance process: build-time SBOMs, vulnerability tracking, provenance, and reports in PDF, HTML, CSV, Excel and JSON.

Switching from Namespace to CRACI

Install the CRACI GitHub App on your organization, with access to all repositories or a selected set, then change the runner label on a job:

runs-on: craci

Move one job at a time, check its SBOM and network trace, and read more about CI/CD integration and build-time SBOM generation.