96% more reported CVEs per day in 2026 than last year.
CRACI

Comparison

CRACI vs WarpBuild

WarpBuild offers fast, low-cost GitHub Actions runners in its cloud or yours. CRACI runs Linux GitHub Actions jobs and records what each one fetched, controls what it can reach, and signs what it produced.

The short answer

WarpBuild is a GitHub Actions runner provider. It offers hosted runners on Linux, Windows and macOS, a fast cache, remote Docker builders, and a bring-your-own-cloud (BYOC) option that runs the same runners in your AWS, GCP or Azure account. CRACI is a GitHub Actions-compatible runner built around supply-chain security: every job produces an SBOM of what it fetched, runs under an egress policy, and produces signed provenance for its artifacts.

The one-line difference: WarpBuild competes on speed, price and where the runner lives, and CRACI on what the runner records and controls. For any single job you choose one runner. A team can still run Linux build jobs on CRACI and macOS or Windows jobs on WarpBuild.

At a glance

CRACI WarpBuild
Record of what each job fetched Package-aware proxy records every job
Build-time SBOM Per job, with a completeness state
Egress policy on the runner Package-source presets, validated before the job BYOC: your own cloud network rules
Signed build provenance Links each artifact to its build
Vulnerability monitoring Monitored SBOMs re-evaluated
CRA evidence and reports PDF, HTML, CSV, Excel, JSON
Windows and macOS runners Linux runners only Windows Server, macOS on M4 Pro
Container-layer caching Local, remote and bind mount layer caches Plus remote Docker builders
Runners in your own cloud BYOC on AWS, GCP or Azure
SOC 2 Type II report Trust Center documents policies and controls
Price, 2 vCPU Linux €0.004 per minute (6 GB RAM). ARM64 at the same rate. $0.004 per minute on x86-64, $0.003 on arm64 (8 GB RAM). BYOC $0.002 plus your cloud bill.
Metering Per second, rounded to the nearest second. Per minute.
  • Included
  • Partly
  • Not included

What WarpBuild does well

  • Platforms and sizes. Linux runners on x86-64 and arm64 from 2 vCPUs and 8 GB of RAM up to 32 vCPUs and 128 GB, Windows Server 2022 and 2025 runners from 4 vCPUs, and macOS runners on Apple M4 Pro. Images carry the same tooling as GitHub-hosted runners, and nested virtualization is available on x86-64.
  • Isolation. Every runner is an ephemeral virtual machine, created for the job and destroyed afterwards, with its own encrypted storage volume.
  • Caching and Docker. An unlimited cache on Linux runners, container-layer caching, snapshot runners that restore a prepared machine state, and remote Docker builders that also work from other CI systems.
  • Bring your own cloud. BYOC runs WarpBuild-managed runners in your own AWS, GCP or Azure account, in any region, with static IPs, spot instances, standby disks and custom VM images. WarpBuild lists BYOC Linux runners at $0.002 per minute, with caching included, on top of what you pay your cloud provider.
  • Enterprise. SOC 2 Type II, region-specific infrastructure on enterprise plans, SAML SSO, SCIM, a 99.9% uptime SLA, and support for GitHub Enterprise Server.

On speed, WarpBuild advertises builds two to ten times faster and says its runners are "built to be the fastest CI/CD platform in the world". Those are WarpBuild's claims; your own pipeline is the fair test.

Where CRACI is different

CRACI treats the build as the source of truth for what you ship.

A record of what the build fetched

While each job runs, a package-aware proxy records traffic to package sources: npm, PyPI, RubyGems, Cargo, Go, Nix and OCI, plus OS packages and source or download presets. Dependency evidence travels with CI caches, so a package restored from a cache is still counted. Each job's SBOM, in CycloneDX or SPDX, carries a completeness state per job and per cache, so you know when the record is complete and when it is not.

Egress policy that comes with the runner

CRACI policies are default deny or default allow, with 24 built-in software-source presets, typed custom sources for npm, PyPI, apt, apk, the Go proxy, Nix, Cargo, OCI registries and Git over HTTPS and SSH, and explicit TLS, TCP, UDP and ICMP rules. Policies are validated before the job starts, fail closed, and send an email alert on a violation. CRACI runners also use a stable egress IP range.

WarpBuild's docs do not describe a per-job egress policy for its hosted runners. With BYOC the runners live in your own network, and WarpBuild's AWS hardening guide shows how to tighten outbound rules with your own security groups, listing the endpoints a runner needs. That works, and it is network plumbing you maintain in your cloud account rather than a policy attached to the job.

Provenance and monitoring

  • Signed provenance links each artifact, including OCI artifacts, to the build that produced it, using Ed25519 over SHA-512. The API traces an artifact to its build, SBOM and network trace. CRACI does not claim a SLSA level.
  • Monitoring of what shipped. Monitored SBOMs are re-evaluated continuously against new vulnerabilities, and findings are aggregated across builds and repositories.

Price

As of September 2026, WarpBuild's hosted Linux runners cost $0.004 per minute for 2 vCPUs and 8 GB on x86-64 and $0.003 per minute on arm64, scaling linearly to $0.064 and $0.048 per minute at 32 vCPUs. Billing is per minute. Sign-up needs no credit card, and a payment method is required once you pass the free usage or credit limit.

CRACI bills €0.002 per vCPU-minute, so 2 vCPUs with 6 GB of RAM cost €0.004 per minute and 32 vCPUs cost €0.064 per minute, with ARM64 at the same rate. Metering is per second, which matters if your pipelines run many short jobs. The Pro plan is €30 per month until end of 2026 and includes 10,000 build minutes. Currencies and memory per vCPU differ (3 GB on CRACI, 4 GB on WarpBuild), WarpBuild's arm64 list price is lower, and BYOC moves the compute cost to your own cloud bill, so compare on your own workload. See CRACI pricing for current terms.

Which one fits

WarpBuild is the better fit when

  • You need macOS or Windows runners. CRACI is Linux only.
  • You want runners in your own AWS, GCP or Azure account. CRACI does not offer customer-hosted runners.
  • You rely on snapshot runners or remote Docker builders today.
  • Lowest cost per minute on arm64 or BYOC is the main goal.
  • Your procurement requires a SOC 2 Type II report today.

CRACI is the better fit when

  • You need to show what went into a release, with a completeness state, from the build itself.
  • You want an egress policy attached to every job without building it into your cloud network.
  • You want signed provenance and monitoring of shipped SBOMs in one place.
  • You need EU data residency, available on CRACI's Enterprise plan.

For the Cyber Resilience Act

The Cyber Resilience Act asks manufacturers to know the components in their products, handle vulnerabilities in them, and keep evidence. WarpBuild's product is CI infrastructure. CRACI automates a significant part of the software supply chain visibility and evidence that companies need for their wider CRA compliance process: build-time SBOMs, vulnerability tracking, provenance, and reports you can export.

Switching from WarpBuild to CRACI

Install the CRACI GitHub App on your organization, with access to all repositories or a selected set, then change the runner label on a job: 

runs-on: craci

Move one job at a time, check its SBOM and network trace, and read more about CI/CD integration and build-time SBOM generation.

Run one job on CRACI

Change runs-on on a single job, run it, and look at the SBOM, the network trace and the bill.

Book a demo