Body: <p>Currently I push to the <a href="https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-container-registry" rel="noreferrer">GitHub Container Registry (GHCR)</a> with my Personal Access Token.</p>
  <p>Is there a method to deploy a <strong>PRIVATE</strong> project &quot;GitHub Container Registry&quot; such that a token will only have access to specified images rather than all of my private images? It seems they have funcitonality that will do this called <a href="https://docs.github.com/en/developers/overview/managing-deploy-keys#deploy-keys" rel="noreferrer">&quot;Deploy Key&quot; but that it only works for the Git Repository itself, not artifact repositories (like GHCR)</a>.</p>
  <p>I don't see anything documented under</p>
  <ul>
  <li><a href="https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-container-registry#pulling-container-images" rel="noreferrer">Working with the Container registry: Pulling container images</a></li>
  <li><a href="https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-container-registry#authenticating-to-the-container-registry" rel="noreferrer">Working with the Container registry: Authenticating to the Container registry
  </a></li>
  </ul>
  <hr />
  <p>At work we use <a href="https://docs.gitlab.com/ee/user/packages/container_registry/#authenticate-with-the-container-registry" rel="noreferrer">GitLab and I know it does have per-project Deploy Keys for the container registry</a></p>
  
Comments: CC BY-SA 4.0
Comments: 2022-09-15T06:23:21.907Z
Comments: We have the same problem. Did you find a solution? But it looks like there is just no way to do proper authentication that does not depend on a personal GitHub account.
Comments: michidk
Comments: CC BY-SA 4.0
Comments: 2022-10-18T07:18:58.840Z
Comments: Same issue here, deploy keys are not supported on GHCR. The only solution seems to be to use a PAT with a full Docker login flow, or by writing a Docker registry "proxy" that removes the authentication or moves it to e.g. the URL schema.
Comments: Niek
Tags: <deployment><github><authentication><ghcr>
Title: Does the GitHub Container Registry provide something like a Deploy Key?
UserDisplayName: Evan Carroll
ThreadText: # Does the GitHub Container Registry provide something like a Deploy Key?
  
  (Asked by: username_0 on 2022-05-14)
  
  Currently I push to the [GitHub Container Registry (GHCR)](https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-container-registry) with my Personal Access Token.
  
  Is there a method to deploy a **PRIVATE** project "GitHub Container Registry" such that a token will only have access to specified images rather than all of my private images? It seems they have funcitonality that will do this called ["Deploy Key" but that it only works for the Git Repository itself, not artifact repositories (like GHCR)](https://docs.github.com/en/developers/overview/managing-deploy-keys#deploy-keys).
  
  I don't see anything documented under
  
  * [Working with the Container registry: Pulling container images](https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-container-registry#pulling-container-images)
  * [Working with the Container registry: Authenticating to the Container registry](https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-container-registry#authenticating-to-the-container-registry)
  
  ---
  
  At work we use [GitLab and I know it does have per-project Deploy Keys for the container registry](https://docs.gitlab.com/ee/user/packages/container_registry/#authenticate-with-the-container-registry)
  
  **Tags:** deployment, github, authentication, ghcr
  
  > **Comments:**
  > **username_1**: We have the same problem. Did you find a solution? But it looks like there is just no way to do proper authentication that does not depend on a personal GitHub account.  
  > **username_2**: Same issue here, deploy keys are not supported on GHCR. The only solution seems to be to use a PAT with a full Docker login flow, or by writing a Docker registry "proxy" that removes the authentication or moves it to e.g. the URL schema.  
  
  ---
  
  ## 0 answers
  
  