GitHub Actions vs Depot
GitHub Actions is GitHub's CI service, and its hosted runners give each job a fresh VM on Azure for up to 6 hours. Depot keeps your GitHub Actions workflows but runs each job on its own fresh EC2 machine instead, with one runs-on label change, a shared fast cache and no stated concurrency limits.
The companies and products
GitHub Actions
GitHub Actions is GitHub's CI/CD service: workflows in your repository run as jobs on runners that GitHub hosts or that you host yourself.
GitHub Actions is a CI service, not a sandbox API. Each job on a GitHub-hosted runner gets a new VM, Linux and Windows on Azure and macOS on GitHub's own Mac fleet, with passwordless sudo, and the VM is gone when the job ends. It is built for building, testing and deploying the code in a repository, and GitHub's own Copilot cloud agent and the Claude and Codex agents on GitHub also run on Actions runners.
- Job length
- Each job can run for up to 6 hours
- Self-hosted runners
- Open-source runner under MIT; usage on self-hosted runners is free
Depot
Depot is a build and CI platform: faster Docker builds, drop-in GitHub Actions runners, its own Depot CI, and newer sandboxes for coding agents.
Depot's main product is GitHub Actions runners: you change one runs-on label and each job runs on a fresh AWS EC2 instance that is thrown away when the job ends, with Linux, Arm, Windows and macOS sizes and a shared fast cache. It also sells remote agent sandboxes that run Claude Code in a container, and a Sandbox SDK in public beta whose sandboxes live at most 24 hours. It is built for engineering teams that want CI and builds to finish sooner, so it is a different kind of product than an agent sandbox, and this page compares where the two overlap.
Which use cases each one fits
For each use case, Battleships prices every sandbox provider on the same workload and sorts them from the cheapest monthly bill up. “100th cheapest of 377” means 99 of the other 376 providers run that workload, with every feature it needs, for less. “With limits” means the provider runs it but misses something, so it is listed after every full match. Open a use case for its whole ranking and what each provider misses.
| Use case and its workload | GitHub Actions: price rank | Depot: price rank | bochka: price rank |
|---|---|---|---|
| Software factory 100 at once · 4 vCPU / 8 GB · 2,200 sessions of 8 h a month An agent that builds an app over days needs one machine with its files in place, and both throw the runner away after each job, so bochka, where the disk, Docker and /dev/kvm stay on one VM, fits better. | 298th of 367, with limits $5,853 a month | 331st of 367, with limits $8,688 a month | 3rd cheapest of 367 $634 a month |
| Always-on AI employees 50 machines 24/7 · 2 vCPU / 4 GB An assistant that lives on its machine all month fits neither: GitHub jobs end at 6 hours, Depot runners end with the job and its Sandbox SDK caps a sandbox at 24 hours. | 333rd of 366, with limits $10,692 a month | 86th of 366, with limits $13,148 a month | 5th cheapest of 366 $657 a month |
| Code interpreter bursts 100 at once · 1 vCPU / 2 GB · 200,000 sessions of 1 min a month Both wait for a fresh machine and bill by the minute per job, which suits builds better than many tiny code runs. | 294th of 345, with limits $721 a month | 311th of 345, with limits $1,188 a month | 186th of 345, with limits $2,000 a month |
| Sandboxes for your users 300 at once · 2 vCPU / 4 GB · 30,000 sessions of 23 min a month Your users' sandboxes need a URL to reach them, and neither documents inbound ports, while GitHub's terms also rule out offering Actions as a service; bochka serves HTTPS on up to 50 ports and raw TCP. | 308th of 361, with limits $2,892 a month | 318th of 361, with limits $3,713 a month | Cheapest of 361 $209 a month |
| RL rollouts 1,000 at once · 2 vCPU / 4 GB · 1,000,000 sessions of 3 min a month | 304th of 360, with limits $14,721 a month | 311th of 360, with limits $17,908 a month | 34th of 360, with limits $2,000 a month |
| Agent evals 250 at once · 4 vCPU / 8 GB · 15,000 sessions of 20 min a month | 303rd of 364, with limits $1,962 a month | 319th of 364, with limits $2,888 a month | 10th cheapest of 364 $200 a month |
| CI runners 40 at once · 8 vCPU / 16 GB · 6,000 sessions of 12 min a month This is what both are built for, and Depot runs your existing workflows with a one-line change; in our CI runners scenario GitHub Actions comes to $1,012 a month and Depot to $1,736, while bochka runs the same jobs on full VMs for $86 but has no managed pipeline or cache. | 100th cheapest of 377 $1,012 a month | 125th cheapest of 377 $1,736 a month | 4th cheapest of 377 $86 a month |
| 24/7 dev boxes 1 machine 24/7 · 4 vCPU / 8 GB A dev box has to stay up and keep what you installed, and both start every job on a fresh machine, so a box that keeps its state all month fits bochka. | 279th of 368, with limits $159 a month | 199th of 368, with limits $534 a month | 18th cheapest of 368 $26 a month |
| Computer-use agents 50 at once · 4 vCPU / 8 GB · 20,000 sessions of 15 min a month Both run headless jobs with no desktop to drive, while bochka streams a 60fps Linux desktop with Chromium and computer use. | 292nd of 369, with limits $1,768 a month | 321st of 369, with limits $2,600 a month | 6th cheapest of 369 $200 a month |
| Browser-use agents 50 at once · 2 vCPU / 4 GB · 30,000 sessions of 10 min a month | 135th of 367, with limits $942 a month | 139th of 367, with limits $1,304 a month | 7th cheapest of 367 $200 a month |
| Scraping & bots (startup scale) 50 at once · 1 vCPU / 2 GB · 100,000 sessions of 3 min a month | 134th of 346, with limits $1,184 a month | 139th of 346, with limits $1,763 a month | 6th cheapest of 346 $90 a month |
| Mass scraping & bots (undetectable) 1,000 at once · 1 vCPU / 2 GB · 3,000,000 sessions of 2 min a month | 301st of 338, with limits $28,971 a month | 312th of 338, with limits $35,108 a month | 71st of 338, with limits $1,800 a month |
| Parallel red teaming 200 at once · 2 vCPU / 4 GB · 5,000 sessions of 30 min a month | 70th of 360, with limits $467 a month | 81st of 360, with limits $863 a month | 2nd cheapest of 360 $200 a month |
| GPU eval jobs 10 at once · 8 vCPU / 32 GB · 500 sessions of 30 min a month | Can't run it | Can't run it | Can't run it |
| macOS agents 5 at once · 4 vCPU / 8 GB · 1,000 sessions of 20 min a month Both rent macOS runners, GitHub on Apple silicon and Intel, Depot on macOS 26, 15 and 14 at 8 CPU / 24 GB; in our macOS agents scenario Depot comes to $248 a month and GitHub Actions to $1,178, and bochka runs Linux only. | 25th of 36, with limits $1,178 a month | 10th of 36, with limits $248 a month | Can't run it |
Key features
| Feature | GitHub Actions | Depot | bochka |
|---|---|---|---|
| Kind of product | CI service built into GitHub; workflows live in the repository | Drop-in GitHub Actions runners, Depot CI and Docker builds, plus agent sandboxes and a beta Sandbox SDK | Sandbox API: create, stop, fork and reach machines from your code |
| Isolation | New VM per job on Azure (Linux, Windows) or GitHub's Mac cloud, with passwordless sudo | A fresh AWS EC2 instance per job, destroyed after it; agent sessions in an isolated container | Full VM with its own kernel on dedicated AMD Ryzen 9 9950X hosts, with root and systemd |
| How long a machine lives | Up to 6 hours per job | Runners end with the job; Sandbox SDK default 120 minutes, at most 24 hours | No session cap on paid plans; you set the time to live |
| Files after a run | Fresh VM each job; carry files with cache, artifacts or custom images | Runners are never reused; shared cache up to 1000 MiB/s; agent sandboxes keep files and the Claude Code conversation | Whole disk saved every minute and on stop; a stopped sandbox costs nothing |
| Fork | No; custom images are a template for new runners | No fork or clone API | Fork a running sandbox with its disk |
| Docker and nested virtualization | Docker, and KVM on Linux runners after adding the runner user to the KVM group | Docker on Linux runners; /dev/kvm only on Depot CI sandboxes, not on its GitHub Actions runners | Docker, root, systemd and /dev/kvm on every machine |
| Getting into the machine | No inbound connections and no first-party SSH | SSH into a running Depot CI job for debugging; no documented inbound ports or URLs | SSH, HTTPS URLs for up to 50 ports, raw TCP, dedicated IPv6 or IPv4 |
| Desktop and computer use | Headless runners; browsers preinstalled for tests | No desktop or computer-use product | Linux desktop streamed at 60fps, Chromium, computer use API |
| Coding agents | Copilot cloud agent, plus Claude and Codex in public preview, working on issues and pull requests on Actions runners | Claude Code only, started and resumed with the depot claude command | Claude Code, Codex and five more preinstalled, driven from outside with a prompt, steer and events API |
| Keeping API keys out of the machine | Secrets enter the job as inputs or environment variables | Secrets are passed into the job or sandbox as environment variables | Credentials proxy for model providers and any HTTPS API; switch a credential to another account when credits run out |
| Jobs at once | 20 on Free, 40 on Pro, 60 on Team, 500 on Enterprise; macOS 5, or 50 on Enterprise | Says its runners have no concurrency limits; macOS capacity is not fully elastic | A sandbox count per plan, with starts capped per minute, hour and day |
| Operating systems and GPUs | Linux x64 and arm64, Windows x64 and arm64, macOS; NVIDIA T4 larger runners | Linux x64 and Arm from 2 to 64 CPUs, Windows Server 2025 and 2022, macOS 26, 15 and 14; GPU runners on Business | Linux x64 only, no GPUs |
| Network rules and regions | Azure; larger runners can join your Azure network in the US, EU and APAC, with static IP ranges | US and EU regions; egress filtering on Linux runners by IP, CIDR or hostname | EU only (Germany, Finland, France), open internet |
| Self-hosting | Open-source runner under MIT on your own machines, free to use | Depot Managed in your own AWS account on the Business plan | No |
Every feature Battleships tracks (43)
| Feature | GitHub Actions | Depot | bochka |
|---|---|---|---|
| Full VM (own kernel) | Yes | Yes | Yes |
| Docker inside | Yes | Yes | Yes |
| Nested virtualization | Yes | Yes | Yes |
| Root | Yes | Yes | Yes |
| Systemd | No | No | Yes |
| Desktop GUI | No | No | Yes |
| Browser | Yes | Yes | Yes |
| Computer-use API | No | No | Yes |
| SSH | No | Yes | Yes |
| Persistent disk | No | Yes | Yes |
| Pause/resume | No | No | Yes |
| Automatic snapshots | No | No | Yes |
| Fork/clone | No | No | Yes |
| Live fork (no pause) | No | No | Yes |
| Memory fork | No | No | No |
| Custom image (Docker or snapshot) | Yes | Yes | Yes |
| ≥24 h sessions | No | Yes | Yes |
| Idle auto-stop | Yes | Yes | No |
| Wake on request | No | No | No |
| HTTPS preview URLs | No | No | Yes |
| Raw TCP inbound | No | No | Yes |
| Public IPv4 | No | No | No |
| Egress allowlist | Yes | Yes | No |
| Secret proxy | No | No | Yes |
| Secret proxy for any API | No | No | Yes |
| Preinstalled agents | Yes | Yes | Yes |
| Agent harness API | Yes | Yes | Yes |
| MCP server | Yes | No | No |
| GPU | Yes | Yes | No |
| Windows | Yes | Yes | No |
| Arm64 | Yes | Yes | No |
| Self-hosting | Yes | No | No |
| BYOC | No | Yes | No |
| Open source | Yes | No | No |
| Scoped API keys | Not published | Not published | Yes |
| Spend limits | Yes | Yes | Yes |
| Usage per sandbox (API) | Yes | No | Yes |
| Audit logs | Yes | Not published | No |
| SSO | Yes | Yes | No |
| SOC 2 | Yes | Yes | No |
| HIPAA | No | Not published | No |
| EU data residency | Yes | Yes | Yes |
| Zero data retention | Not published | Not published | Yes |
Performance
There is no comparable CPU measurement for GitHub Actions hosted runners or Depot runners: neither was part of the StarSling hpc-sandbox-benchmarks run. On that Node.js build-and-test benchmark at 4 vCPU / 8 GB, bochka did 26.69 runs per second on dedicated AMD Ryzen 9 9950X hosts.
Node.js build-and-test loop at 4 vCPU / 8 GB, higher is better. Measured with the open hpc-sandbox-benchmarks suite. GitHub Actions and Depot have no published run in this suite yet, so there is no like-for-like number to compare.
Pricing in five scenarios
Each bill is priced from the providers' public price lists by the open Battleships engine, with the cheapest plan that runs the scenario.
| Scenario | GitHub Actions, a month | Depot, a month | bochka, a month |
|---|---|---|---|
| One coding agent, workdays 4 vCPU / 8 GB, 50 GB disk, 8 hours a day, 22 days a month, files kept between days | $80 · Team · with limits | $122 · Developer · with limits | $20 · $20/mo |
| One agent that never stops 4 vCPU / 8 GB, 50 GB disk, running 24/7 all month | $354 · Team · with limits | $534 · Developer · with limits | $26 · $20/mo |
| 50 agents in parallel 50 machines of 4 vCPU / 8 GB at once, 8-hour sessions, 1,100 sessions a month, Docker inside | $3,814 · Team · with limits | $5,710 · Developer · with limits | $317 · $20/mo × 3 seats |
| Sandboxes for your users 2 vCPU / 4 GB, 30,000 sessions of 10 minutes a month, up to 300 at once | $1,092 · Enterprise Cloud · with limits | $1,628 · Developer · with limits | $200 · $100/mo × 2 seats |
| 1,000 short jobs at once 2 vCPU / 4 GB, 1,000 at once, 3 minutes each, 200,000 jobs a month | $2,721 · Enterprise Cloud · with limits | $3,588 · Developer · with limits | $2,000 · $2000/mo · with limits |
GitHub Actions: GitHub bills per minute per job, rounding each job up to the next whole minute, from $0.006 a minute for 2-core Linux. Plans include monthly minutes for standard runners only, and larger and GPU runners are always billed.
Depot: Depot plans cost $20 or $200 a month and include GitHub Actions, Depot CI and Docker build minutes; after that a 2-CPU Linux runner costs $0.006 a minute and bigger sizes multiply it. Agent sandboxes cost $0.01 a minute.
Depot: Plans start at $20 a month, and the whole fee is usage credit spent per second while a sandbox runs. A stopped sandbox costs nothing and keeps its disk.
Limits in those scenarios
Neither fits the agent scenarios as priced, because both are CI runners whose machine is gone when the job ends; GitHub also stops each job at 6 hours and keeps no disk. For 1,000 short jobs at once, GitHub Enterprise Cloud stops at 500 concurrent jobs, while Depot says it has no concurrency limits and does not publish an egress price. bochka's limits are a sandbox count per plan and starts per minute, hour and day, so its $2,000 plan queues starts above 90 a minute.
| Scenario | GitHub Actions | Depot | bochka |
|---|---|---|---|
| One coding agent, workdays |
|
| None that bite |
| One agent that never stops |
|
| None that bite |
| 50 agents in parallel |
|
| None that bite |
| Sandboxes for your users |
|
| None that bite |
| 1,000 short jobs at once |
|
|
|
Which one should you use?
Use GitHub Actions when
your code lives on GitHub and you want CI with no extra vendor, free self-hosted runners, GPU runners, or Copilot, Claude and Codex working on your issues and pull requests.
- Nothing extra to set up. If your code is on GitHub, hosted runners work from pushes and pull requests with no second vendor, account or bill.
- A free runner you host. Teams with their own machines can run the open-source runner on them, and GitHub charges nothing for those minutes.
- GitHub's own coding agents. Teams that want Copilot, Claude or Codex working on issues and pull requests get them on Actions runners, inside GitHub.
Use Depot when
you already use GitHub Actions and want faster runners with a shared cache, no stated concurrency cap, outbound traffic rules, or quicker Docker builds, on Linux, Windows or macOS.
- Same workflows, a one-line switch. Teams already on GitHub Actions change one runs-on label and get Depot's runners and a shared cache up to 1000 MiB/s.
- No stated concurrency cap. Teams that run many jobs at once avoid GitHub's per-plan job limits, since Depot says its runners have no concurrency limits.
- Egress rules and faster Docker builds. Teams that must limit outbound traffic can filter it by IP, CIDR or hostname, and Depot also speeds up Docker image builds.
Where bochka fits
Both are CI runners, and for building and testing a GitHub repository you should pick one of them. If what you are really running is AI agents that work for hours, keep their files, run servers people visit or click through a browser, both make you squeeze that into jobs on throwaway machines. bochka gives each agent a full Linux VM that stays.
A machine that outlives the job
GitHub stops a job at 6 hours and Depot's runners end with the job, and both throw the machine away. The next run reinstalls tools and reclones the repo, or you keep your own cache and image pipeline.
Reachable from outside, with a desktop
GitHub runners take no inbound connections, and Depot documents SSH only for debugging a CI job. A preview server or webhook needs a tunnel you add to each short-lived machine, and neither has a screen for computer use.
Agents driven from outside, keys kept out
GitHub's agents work through issues and pull requests, and Depot runs only Claude Code from its CLI. Both pass secrets in as environment variables, where an agent hit by a prompt injection can read them.
Use bochka when what you run is AI agents on Linux: one full VM that keeps its disk and runs past any job, with Docker and /dev/kvm, a 60fps desktop, URLs you can reach and real API keys kept out of the machine. Compare it one to one: bochka vs GitHub Actions and bochka vs Depot.
Questions people ask
Is GitHub Actions cheaper than Depot?
In our CI runners scenario, yes: GitHub Actions comes to $1,012 a month against $1,736 on Depot, and both list 2-CPU Linux at $0.006 a minute. For macOS it flips: our macOS agents scenario comes to $248 a month on Depot and $1,178 on GitHub Actions. bochka runs the CI scenario for $86 a month.
Which is faster, GitHub Actions or Depot?
We have no comparable CPU measurement for either: neither was part of the hpc-sandbox-benchmarks run. Depot adds a shared cache of up to 1000 MiB/s and faster Docker builds. bochka did 26.69 runs per second on that test at 4 vCPU / 8 GB.
Does Depot replace GitHub Actions?
It replaces GitHub's hosted runners, not GitHub Actions itself. Your workflows stay in the repository, and you change the runs-on label so jobs run on Depot's machines. Depot also has its own Depot CI.
Can GitHub Actions and Depot run Docker and Android emulators?
Both run Docker on Linux runners. GitHub exposes KVM on Linux runners after you add the runner user to the KVM group, while Depot offers /dev/kvm only on Depot CI sandboxes, not on its GitHub Actions runners. bochka has Docker, systemd and /dev/kvm on every machine.
Can I run AI coding agents on GitHub Actions or Depot?
GitHub runs Copilot, and Claude and Codex in preview, on Actions runners for work on issues and pull requests. Depot sells remote sandboxes for Claude Code and a Sandbox SDK whose sandboxes last at most 24 hours. On both, secrets reach the agent as environment variables.
Is bochka SOC 2 compliant?
SOC 2 is in progress. We're open about where we stand: live status at status.bochka.xyz and our data retention policy at docs.bochka.xyz/data-retention.
Try bochka
Install the CLI, then run bochka new.
Product preview
More comparisons
- bochka vs GitHub Actions
- bochka vs Depot
- GitHub Actions vs CircleCI
- GitHub Actions vs Blacksmith
- GitHub Actions vs WarpBuild
- GitHub Actions vs Buildkite
- GitHub Actions vs GitLab.com hosted runners
- GitHub Actions vs Bitrise
- GitHub Actions vs Codemagic
- GitHub Actions vs RunsOn
- GitHub Actions vs Ubicloud
- CircleCI vs Depot