CRACI vs Ubicloud

The short answer

Ubicloud is an open source alternative to the big clouds, and its managed GitHub Actions runners are among the cheapest you can buy: a 2 vCPU runner costs $0.002 per minute on premium x64 hardware and $0.00125 on standard x64 or arm64, as of September 2026. If your goal is to cut the GitHub Actions bill for Linux jobs, Ubicloud costs less than CRACI, and it runs in Europe too.

CRACI is CI that handles supply chain security natively. It is also a GitHub Actions-compatible runner, and switching is the same kind of one-line change, but the security is part of the runner rather than a tool added to it. CRACI records every external dependency the build fetched, enforces an egress policy on the build network, and turns that record into SBOMs, vulnerability monitoring and evidence. Both products compete for the same runner budget, so you choose one.

At a glance

What Ubicloud does well

Price. Ubicloud runs on rented bare metal and passes the saving on. It says its runners cut the GitHub Actions bill four to seven times and offer seven times the price-performance of GitHub-hosted runners. Those are Ubicloud's figures, but the list prices back up the direction: at $0.00125 to $0.002 per 2 vCPU minute, it is well below both GitHub and CRACI.

Hardware choice. Standard x64 runners use AMD EPYC processors, premium runners use AMD Ryzen 9 7950X3D chips tuned for single-thread speed, and arm64 runners use Ampere Altra with a dedicated physical core per vCPU. New accounts get premium by default and fall back to standard when premium capacity is full. Sizes run from 2 to 30 vCPUs, with images built from GitHub's own runner-images templates.

Caching without workflow changes. Ubicloud's transparent cache serves actions/cache, the setup actions and Docker layer caching from storage close to the runners, which Ubicloud says is up to four times faster, with 30 GB per repository per week. SSH access helps debug a failing workflow.

Open source and isolation. Ubicloud's code is public under AGPL-3.0, so you can read how it works or run it yourself. Each job gets a clean, ephemeral KVM virtual machine whose block storage is deleted afterwards, registered through GitHub's just-in-time runner API, and runners are hosted in data centers in Germany.

Price and sizing

Ubicloud's list price is lower at every size. CRACI's $0.004 per 2 vCPU minute is twice Ubicloud's premium x64 rate and more than three times its standard and arm64 rate. CRACI meters per second, rounded to the nearest second, and Ubicloud bills by the minute, so short jobs narrow the gap: a 30-second job costs $0.002 on CRACI, the same as one billed minute on Ubicloud's premium x64. Shapes differ too: Ubicloud's x64 runners have 4 GB of RAM per vCPU, its arm64 runners 3 GB, and a CRACI compute unit is 1 vCPU with 3 GB. See CRACI pricing for current terms.

Price is not where CRACI competes. Both say their runners are about twice as fast as GitHub-hosted runners; CRACI gets there with faster hardware, shorter queue times and caching. We have not benchmarked the two against each other.

Where CRACI is different

A record of what the build fetched

While each job runs, a package-aware proxy records traffic to package sources: npm, PyPI, RubyGems, Cargo, Go, Nix, OCI, apt, apk and Git sources, plus download presets. Dependency evidence travels with CI caches, so packages restored from a cache are still counted. That includes the hidden dependencies no lockfile lists, such as code downloaded by install hooks or build scripts, and base image layers. Every job produces a CycloneDX or SPDX SBOM with a completeness state per job and per cache: Complete, Complete with connections, Incomplete, Unavailable or Not recorded.

Control over what the build can reach

A clean VM per job stops one job from poisoning the next. It does not stop a compromised dependency from sending your secrets somewhere during the job. CRACI's egress policy does: default deny or default allow, 24 built-in software-source presets, typed custom sources, and explicit TLS, TCP, UDP and ICMP rules. Policies are validated before the job starts, fail closed, and send an alert on a violation. Because the policy allows only what the build needs, it blocks exfiltration to hosts the build does not need, even in an attack nobody has seen before.

Provenance and monitoring

The API returns SBOMs, network traces and provenance. CRACI does not sign provenance. It aggregates vulnerabilities across builds and repositories and keeps re-evaluating monitored SBOMs.

Two different security questions

Ubicloud's security work answers "is the runner safe to trust with my jobs?": isolated VMs, just-in-time registration, encryption and published source code. CRACI answers that question too, with isolated virtual machines, no stored source code and ISO 27001 certification, and then a second one: "what did this build pull in, and where did it connect?" That second answer is what an auditor, a customer or the Cyber Resilience Act asks you for.

Book a demo to see the SBOM, network trace and provenance from one of your own workflows.

Which one fits

Ubicloud is the better fit when

• The lowest price per minute for Linux jobs is the main goal.
• You want an open source platform you could also run yourself.
• You already use Ubicloud for compute or PostgreSQL and want CI on the same bill.

CRACI is the better fit when

• You ship software where you must show what went into each release, from the build itself.
• You want to restrict what builds can reach, with a policy that fails closed.
• You need monitoring of what shipped, without adding tools to every workflow.
• You need EU data residency as a contractual term, available on CRACI's Enterprise plan.

What you give up with CRACI. Ubicloud's price, which is lower at every size, and its open source code. What you gain is a build record that security and compliance can use without another scanner in the pipeline.

For the Cyber Resilience Act

The EU Cyber Resilience Act expects manufacturers to know what is in each release and to handle its vulnerabilities, with reporting obligations from September 2026 and full application from December 2027. A low-cost runner does not produce that evidence by itself; you would add SBOM and scanning tools to your workflows. CRACI produces it from the build record and exports SBOMs as CycloneDX or SPDX. It automates a significant part of the software supply chain visibility and evidence that companies need for their wider CRA compliance process.

Moving from Ubicloud

CRACI replaces the runner, not GitHub Actions. Workflows and the GitHub UI stay the same, and the job label becomes runs-on: craci. Jobs get Docker Engine, Buildx and Compose v2, a GitHub-compatible Ubuntu 24.04 image, and nested virtualization on x86-64. Read more about CI/CD integration and build-time SBOM generation. Startups can apply for the startup program.

Ubicloud vs CRACI: common questions

Pricing, speed, hosting and security, answered from each vendor's published information

What is Ubicloud?

Ubicloud is an open source cloud: compute, managed PostgreSQL, Kubernetes and GitHub Actions runners, built on bare-metal providers such as Hetzner, Leaseweb and AWS Bare Metal. You can use its managed service or run it yourself. Its GitHub Actions runners switch over with one label, and each job gets a clean, ephemeral virtual machine. Ubicloud was part of Y Combinator's W24 batch and raised $16M in seed funding.

How much do Ubicloud runners cost?

As of September 2026, a 2 vCPU x64 runner costs $0.00125 per minute on standard hardware and $0.002 on premium hardware, which new accounts get by default. A 2 vCPU arm64 runner costs $0.00125. Billing is by the minute, and every account gets a $2.50 monthly credit, about 1,250 minutes. Ubicloud's marketing page also quotes standard runners from $0.0010 per minute; the figures here come from its pricing documentation.

Is Ubicloud cheaper than CRACI?

Yes. CRACI charges $0.004 per 2 vCPU minute on x86-64 and ARM64 alike. Ubicloud's 2 vCPU runners cost $0.002 on premium x64 and $0.00125 on standard x64 and arm64. CRACI meters per second and Ubicloud per minute, which narrows the gap on short jobs: a 30-second job costs $0.002 on CRACI, the same as one billed minute on Ubicloud's premium x64. What CRACI adds on the runner is the build record: an SBOM for every job, an egress policy, provenance data and vulnerability monitoring.

Is Ubicloud faster than CRACI?

Ubicloud says its runners go twice as fast as GitHub-hosted runners, and CRACI runs builds about twice as fast as GitHub-hosted runners, thanks to faster hardware, shorter queue times and caching. We have not benchmarked the two against each other, so run the same workflow on both and compare.

Does Ubicloud generate SBOMs or build provenance?

Not among its documented features. Ubicloud's runners focus on price, performance and job isolation. CRACI records the packages every job fetches, including packages restored from caches, and produces a CycloneDX or SPDX SBOM with a completeness state. The API returns SBOMs, network traces and provenance.

Can Ubicloud restrict what a build can reach on the network?

An egress policy for runner jobs is not among the features in Ubicloud's GitHub Actions documentation, which covers isolated VMs, just-in-time runner registration and metadata log retention. CRACI enforces an egress policy at the runner: default deny or allow, 24 built-in software-source presets, validated before the job starts and failing closed.

Where do the jobs run, and can data stay in the EU?

Ubicloud allocates its GitHub Actions runners across data centers in Germany. CRACI runs builds on European bare-metal infrastructure, with EU data residency on the Enterprise plan. CRACI does not store your source code; it is processed in the job VM for the duration of the build.

Do I have to rewrite my GitHub Actions workflows to switch?

No. Both products replace the runner, not GitHub Actions. Workflows, triggers and the GitHub UI stay the same; on CRACI the job label becomes runs-on: craci.