CRACI vs Northflank

The short answer

Northflank is a developer platform on Kubernetes. It builds your code from Git, deploys it as services and jobs, runs managed databases, spins up a preview environment for every pull request, and can do all of it inside your own cloud account. It presents itself as an alternative to GitHub Actions because building and deploying happen in the same product.

CRACI takes the opposite route. You keep GitHub Actions, your workflows and the GitHub UI, and CRACI replaces the runner the jobs run on. Because CRACI is the runner, it sees what each build pulls in: every job produces an SBOM of the packages it actually fetched, runs under an egress policy, and feeds vulnerability tracking across your builds. Runs on CRACI are about twice as fast as on GitHub-hosted runners, thanks to faster hardware, shorter queue times and caching.

The one-line difference: Northflank decides where your software runs; CRACI records what went into it.

At a glance

What Northflank does well

Build, deploy and host in one place. Northflank builds each commit from a Dockerfile or buildpack, with build rules for branches and pull requests, path filters for monorepos and BuildKit caching for Dockerfile builds. The image goes straight into a deployment with rolling or blue-green updates, instant rollbacks and promotion from staging to production. It works with GitHub, GitLab and Bitbucket.

Preview environments. Templates describe a full environment, with services, databases and jobs, and Northflank deploys one automatically when a pull request opens.

More than containers. Managed Postgres, MySQL, MongoDB and Redis, cron jobs, autoscaling, custom domains with automatic TLS, secrets management, logs and metrics, GPU workloads from NVIDIA L4 to H100 with fractional GPUs, and microVM sandboxes for running untrusted or AI-generated code.

Your own cloud. Bring your own cloud runs workloads in your AWS, GCP, Azure, Oracle, Civo, CoreWeave or Nebius account, or on any Kubernetes cluster such as EKS, GKE, AKS, Rancher or OpenShift. Builds can run on the same cluster, on a dedicated build cluster, or on Northflank's managed build infrastructure.

Enterprise controls. SSO with any SAML or OIDC provider, role-based access, audit logs exported to a SIEM, build scanning with policies based on CVE severity, image signing policies, and air-gapped deployments. Northflank states it is SOC 2 Type 2 and HIPAA compliant, and says more than 2,000 startups and enterprises use it.

If you want one platform to build, preview, deploy and host your applications, Northflank is built for that.

Where CRACI is different

You keep GitHub Actions

Northflank's builds turn each commit into a container image from a Dockerfile or buildpack. CRACI keeps the workflows you already have: matrix builds, tests, linters, reusable actions and the GitHub UI stay as they are, and the job runs on a CRACI runner instead of a GitHub-hosted one. Any job that runs in GitHub Actions gets the same record, not only the ones that build a container image.

A record of what the build fetched

While each job runs, a package-aware proxy records traffic to package sources: npm, PyPI, RubyGems, Cargo, Go, Nix, OCI, apt, apk and Git sources, plus download presets. Dependency evidence travels with CI caches, so packages restored from a cache are still counted. CRACI records the hidden dependencies that lockfile-based tools miss, such as code downloaded by install scripts, and every component in the SBOM was actually pulled into the build. Each job's SBOM, in CycloneDX or SPDX, carries a completeness state: Complete, Complete with connections, Incomplete, Unavailable or Not recorded.

Control over what the build can reach

Northflank's network policies isolate projects from each other. CRACI controls the build's own outbound traffic: an egress policy at the runner, default deny or default allow, with 24 built-in software-source presets, typed custom sources, and explicit TLS, TCP, UDP and ICMP rules. Policies are validated before the job starts and fail closed. A default-deny policy allows only what the build needs, so it blocks exfiltration to an attacker's host even for an attack nobody has seen before, and a violation sends an alert.

Vulnerability tracking across builds

CRACI keeps re-evaluating monitored SBOMs as new advisories appear, aggregates findings across builds and repositories, and shows which past builds contained a vulnerable dependency, so you know the period you were affected. Security teams triage findings and route them to the team that owns the fix, and policy gates can stop a build that contains a specific CVE. Northflank's build scanning, on its Enterprise plan, checks images against CVE severity policies; it does not keep a record of what each build fetched.

What Northflank has that CRACI does not

CRACI does not sign images or provenance; Northflank Enterprise can enforce image signing. The CRACI API returns SBOMs, network traces and provenance data, unsigned.

Book a demo to see the SBOM, network trace and vulnerabilities from one of your own workflows.

Price

As of October 2026, Northflank charges $0.01667 per vCPU-hour and $0.00833 per GB-hour of memory on its managed cloud, prorated per second and billed monthly, with fixed compute plans from $2.70 a month and a free Developer Sandbox. GPUs are priced by the hour, from $0.80 for an NVIDIA L4. Its pricing page does not list a separate rate for builds; builds run on a build plan you choose. In your own cloud, Northflank charges a fee per cluster, vCPU and GB of memory, and your cloud provider bills the machines.

CRACI charges only for build minutes: $0.002 per vCPU-minute ($0.004 for a default 2 vCPU runner), metered per second, with no monthly fee and no per-SBOM charge. On list compute rates Northflank is lower per vCPU-hour. The two buy different things, though: Northflank's rate pays for compute you deploy on, and CRACI's pays for GitHub Actions jobs with the SBOM, egress policy and vulnerability tracking included. See CRACI pricing for current terms.

Which one fits

Northflank is the better fit when

• You want one platform to build, deploy and host applications, with databases and preview environments.
• You are ready to move build logic out of GitHub Actions into Northflank's builds.
• Your code lives on GitLab or Bitbucket.
• You need workloads or builds inside your own cloud account today, or GPU workloads.

CRACI is the better fit when

• You want to keep GitHub Actions and make your builds faster on the same workflows.
• You need to show what went into each release, from the build itself, with a completeness state.
• You want to control what builds can reach, with a policy that fails closed.
• You need vulnerability tracking across everything you build, and EU data residency on the Enterprise plan.

The two are not exclusive. CRACI does not deploy or host software. Northflank documents triggering its deployments from GitHub Actions, so a team can build on CRACI, keep the build record, and deploy the image on Northflank.

What you give up with CRACI. Deployment, hosting, databases, preview environments and GPUs, which CRACI does not offer, and CI beyond GitHub Actions: GitLab CI and Jenkins are on the roadmap. CRACI runs Linux jobs only today, with Windows and macOS on the roadmap, and customer-hosted runners are on the roadmap for Enterprise.

For the Cyber Resilience Act

The EU Cyber Resilience Act expects manufacturers to know what is in each release and to handle its vulnerabilities, with reporting obligations from September 2026 and full application from December 2027. Northflank's product is the platform your software runs on, and its security features protect that platform and its images. CRACI produces evidence from the build record and exports SBOMs as CycloneDX or SPDX, including vulnerabilities. It automates a significant part of the software supply chain visibility and evidence that companies need for their wider CRA compliance process.

Running your builds on CRACI

CRACI replaces the runner, not GitHub Actions, and runs still appear in the GitHub UI. Any workflow runs on CRACI with one line:

runs-on: craci

Read more about build-time SBOM generation, compare CI/CD platforms, or apply for the startup program.

Northflank vs CRACI: common questions

Builds, SBOMs, pricing and hosting, answered from each vendor's published information

What is Northflank?

Northflank is a developer platform built on Kubernetes. It builds your code from Git, deploys services, jobs and databases, creates preview environments for pull requests, runs GPU workloads and sandboxes, and can run all of it in your own cloud account. It positions itself as an alternative to GitHub Actions because it builds and deploys in one product.

Is Northflank a GitHub Actions runner?

No. Northflank replaces the CI pipeline with its own builds: it builds each commit from a Dockerfile or buildpack and deploys the result. It can also be triggered from an existing GitHub Actions workflow. CRACI is the opposite approach: you keep GitHub Actions, and CRACI replaces the runner your jobs run on.

Does Northflank generate SBOMs?

Not among its documented features. Its Enterprise plan adds build scanning with policies based on CVE severity, and image signing policies. CRACI records the packages every job fetches, including packages restored from caches, and produces a CycloneDX or SPDX SBOM with a completeness state for every job.

Is Northflank cheaper than CRACI?

On published compute rates, yes. Northflank lists $0.01667 per vCPU-hour and $0.00833 per GB-hour of memory, prorated per second, and does not list a separate build rate. CRACI charges $0.002 per vCPU-minute ($0.004 for a default 2 vCPU runner), metered per second, with no monthly fee. The two sell different things: Northflank prices hosting and builds, CRACI prices GitHub Actions jobs with the SBOM, egress policy and vulnerability tracking included.

Can I keep hosting on Northflank and build on CRACI?

Yes. CRACI does not deploy or host applications. Northflank documents triggering its deployments from GitHub Actions, so a workflow can run on CRACI, record what the build fetched, and hand the image to Northflank for deployment.

Can either run in my own cloud?

Northflank can: its bring your own cloud option runs workloads, and optionally builds, in your AWS, GCP, Azure, Oracle or other cloud account, or on any Kubernetes cluster. CRACI runs managed runners on European infrastructure today, with customer-hosted runners on the roadmap for Enterprise.