Managed GitHub Actions runners: an honest market map

GitHub-hosted runners are convenient and expensive. A 2 vCPU Linux runner costs $0.006 per minute (GitHub cut the rate from $0.008 in January 2026), and time is rounded up to the minute. For a team with dense CI that’s a visible line on the bill. GitHub also announced a $0.002-per-minute “platform fee” for self-hosted runners from March 2026, then postponed it indefinitely after the backlash: self-hosted is still free, though GitHub writes↗ (opens in new tab) that the control plane has real costs and has so far been subsidized by GitHub-hosted prices.

So a whole market of third-party runners grew around GitHub Actions: the same runs-on: line, only cheaper and faster. There are already more than a dozen players, and they differ a lot — from “cheap on gaming CPUs” to “run it in your own cloud.” Let’s look at how to read this market, walk through the main services with checkable facts, and show where tempus.build sits.

The four axes runners differ on

Everyone’s marketing sounds the same: “2× faster, half the price.” To compare on substance, it helps to look at four independent axes.

1. Price and billing. The per-minute rate — and how it’s counted: per minute rounded up (like GitHub) or per second. Plus the hidden lines: cache storage, egress, concurrency charges.
2. Isolation. What the job’s untrusted code runs inside: a container sharing the host kernel, or a separate virtual machine (a full VM or a micro-VMA lightweight VM: a strong VM boundary (its own kernel, hardware virtualization), but close to a container in weight and start-up time.). This is the security axis — how hard it is for a neighbour on the same server to break out of the sandbox.
3. Geography and data residency. Where your code physically runs and your artifacts are stored: US, EU, your own cloud. For teams under GDPR or internal rules that’s not a detail.
4. Supply chain. What’s known about the runner image itself: is it signed, is there an SBOMSoftware Bill of Materials — a machine-readable inventory of every component and dependency inside an artifact (image): what is in it and at which versions. tempus.build images publish it in the CycloneDX format. and SLSASupply-chain Levels for Software Artifacts — an industry standard of supply-chain security levels; the levels describe how strongly an artifact's origin is proven. provenance, is it scanned for vulnerabilities. Who built the thing your code runs inside.

No single axis is “the main one” — the question is which of them matter to you. Now, where everyone stands.

Who’s who

Briefly and by the facts (prices and specs as of October 2026, from the services’ public pages; claimed speedups are flagged as claims — almost nobody publishes a reproducible methodology).

• Depot — managed runners on their own AWS, a separate EC2 VM per job. Its strong suit is container-build caching (native multi-arch). Plans start at $20/month with included minutes; beyond those it’s $0.006 per minute for 2 vCPU, tracked per second and billed in whole minutes per month. Linux x64/arm, macOS, Windows, GPU. On the security side, what’s verifiable is SOC 2 Type II; SBOMSoftware Bill of Materials — a machine-readable inventory of every component and dependency inside an artifact (image): what is in it and at which versions. tempus.build images publish it in the CycloneDX format./SLSASupply-chain Levels for Software Artifacts — an industry standard of supply-chain security levels; the levels describe how strongly an artifact's origin is proven. exist, but only for container builds (via BuildKit), not for the runners as a whole.
• Blacksmith — managed on bare metal with “gaming” CPUs (their wording) at high clock speed, each job in a micro-VMA lightweight VM: a strong VM boundary (its own kernel, hardware virtualization), but close to a container in weight and start-up time. on Firecracker. Linux from $0.004 for 2 vCPU, Windows $0.008, macOS available. The cache plugs in via their actions. SOC 2 Type II, ISO 27001 data centres. Hardware sits with providers in the US and EU (security page↗ (opens in new tab)), but the public plans don’t let you choose a region.
• Namespace — its own servers and its own hypervisor (which one, they don’t disclose), a micro-VM per job. NVMe cache with copy-on-write. From $0.002 for 2 vCPU/4 GB (prepaid), billed per minute. SOC 2 Type II. Specific regions aren’t named; data residency is advertised as configurable, but the public pricing doesn’t state the terms.
• WarpBuild — managed plus BYOC (runners in your AWS/GCP/Azure). “Ephemeral VMs,” but they don’t name the hypervisor. From $0.004 for 2 vCPU (arm $0.003), Linux x64/arm, macOS, Windows. SOC 2 Type II. Region-specific infrastructure comes with enterprise plans or via BYOC, i.e. on your side.
• Ubicloud — an open-source (AGPL) alternative to AWS, runners on KVMKernel-based Virtual Machine — the Linux kernel's hardware-virtualization layer that the VMMs launched by Kata run on. + Cloud Hypervisor. EU sites — Hetzner. A 2 vCPU premium runner is $0.002 per minute, billed per minute. Per the 2026 price adjustment↗ (opens in new tab), standard x64 runners are no longer available to new customers, although the pricing page↗ (opens in new tab) still lists standard at $0.00125 with premium switchable off in settings. Linux x64/arm only. SOC 2 Type II. Strong suit: it’s all open source, you can read it and self-host.
• Actuated and RunsOn — a different model: not “we host it for you” but runners in your own infrastructure. Actuated is a control plane as a service, while the Firecracker micro-VMs run on your servers; you pay per server, not per minute. RunsOn deploys into your AWS (EC2 per job): you pay for a licence plus AWS at AWS rates, but you run the AWS yourself.

Here are the same services across our four axes:

Two caveats about the market. BuildJet has shut down (its last jobs ran on 31 March 2026), explaining that GitHub improved its hardware and added larger runners. The Cirrus Labs team joined OpenAI (announced 7 April 2026), and Cirrus Runners aren’t taking new customers. The takeaway for a buyer: with a third-party runner, check what its edge rests on and whether it survives GitHub’s next price cut.

Where tempus.build sits on this map

We’re not the cheapest — Ubicloud’s and Namespace’s lowest rates are below ours. And “we have a micro-VM and they don’t” isn’t true either: Firecracker micro-VMs run under Blacksmith and Actuated, and Ubicloud uses Cloud Hypervisor. Our niche is the intersection of axes, which is rare on the market.

• Competitive price, transparent billing. A 2 vCPU runner costs $0.004 per minute and a 4 vCPU one $0.008. Both are a third cheaper than GitHub-hosted of the same size ($0.006 and $0.012). We charge per second, without rounding up. But the main saving is fewer minutes: Docker images, apt, Go, Maven/Gradle, NuGet, RubyGems and conda go through a pull-throughA registry cache proxy: on the first request it pulls the package from the upstream registry and stores it; later builds take it locally, without going out to the internet. cache in the same data-centre region as the runners; npm, pip and cargo go direct. For a typical workflow we estimate a 1.8–2.5× speedup, and we’ve seen up to 5× on real heavy pipelines. That’s an estimate, not a measurement.
• Isolation for untrusted code. Every job runs in a hardware-virtualized micro-VMA lightweight VM: a strong VM boundary (its own kernel, hardware virtualization), but close to a container in weight and start-up time. on Kata Containers + QEMU/KVM. It’s the same isolation class as Firecracker at Blacksmith and Actuated: a separate guest kernel per job. The difference is the VM model: QEMU emulates more devices and fits more workloads, while Firecracker is more minimal and has a smaller attack surface. It’s more accurate to frame the difference as “Kata/QEMU versus Firecracker” than “VM versus container.” More in the Kata isolation deep-dive.
• EU by default, not for an extra fee. Jobs execute in the EU (Finland), no enterprise plan needed; logs, artifacts and the Actions cache are still stored by GitHub. For comparison: Blacksmith’s public plans don’t offer a region choice, Namespace doesn’t state residency terms in its pricing, WarpBuild ties region to enterprise or BYOC, and Depot is US-centric for runners. The direct EU neighbour on this axis is Ubicloud.
• Supply chain almost nobody has. Runner images are signed with cosignA Sigstore tool for signing and verifying container images and artifacts. In keyless mode the signature is bound to an OIDC identity and needs no long-lived keys., come with an SBOMSoftware Bill of Materials — a machine-readable inventory of every component and dependency inside an artifact (image): what is in it and at which versions. tempus.build images publish it in the CycloneDX format. and SLSASupply-chain Levels for Software Artifacts — an industry standard of supply-chain security levels; the levels describe how strongly an artifact's origin is proven. provenance, and are scanned with trivyA vulnerability scanner: checks an image for known CVEs in OS packages and dependencies. In CI it acts as a gate that blocks publishing on fixable HIGH/CRITICAL findings. (OS packages) before signing. None of the other services in the table publishes this — more in the piece on the runner-image supply chain.

So tempus.build is for when you need isolation for untrusted code + execution in the EU + image provenance at once, at a competitive price. If the lowest price is all that matters, there are cheaper options on the map, and we don’t hide that.

What we don’t have yet

The map would be dishonest without this section.

• Linux only. Ubuntu, no macOS, Windows, ARM or GPU runners. If your team needs another platform, get in touch and we’ll discuss it.
• One EU region. You can’t choose another site yet.
• GitHub organizations only. Personal accounts aren’t supported yet.
• Private repositories only. Public repositories aren’t served yet.
• No certifications yet. We don’t have SOC 2 or ISO; Depot, Blacksmith, Namespace, WarpBuild and Ubicloud already have a formal audit (SOC 2 Type II). Our security argument today is architectural (isolation + supply chain), not a certificate on the wall.
• We’re new. tempus.build launched in July 2026. It’s an early stage, and we don’t hide it.

How to choose

A simple heuristic from the map:

• Want the lowest price → Ubicloud, Namespace, RunsOn (in your own AWS).
• Need macOS, Windows or GPU → get in touch and we’ll discuss your case.
• Want runners in your own cloud or on your own servers → RunsOn (AWS), Actuated (bare metal).
• Focus on container-build cache → Depot; on an NVMe cache next to the runners → Namespace, tempus.build.
• You need isolation for untrusted code + execution in the EU + image provenance at a competitive price → tempus.build.

Teams on GitHub Actions have a choice beyond GitHub-hosted. We don’t aim to be the cheapest; we bet on the combination of security, geography and price. See how it works on the Security & isolation page, and estimate the cost from your own runs after installation in Coverage.