I have created docker image with name us.gcr.io/my-project/my-image
and I want to create service account which will have permission to pull & push only this specific docker image.
https://cloud.google.com/container-registry/docs/access-control
As I understood I need to provide access to the whole bucket where all images are stored. Is it possible to set up permissions on specific image without creating a new google project (the only way i see now)?
You can't do it directly with Google Container Registry. If you provide the Storage object viewer role to a service account, it can see all the images in all your container registry.
However, you can do it with Artifact repository. For this
Then you can access to your image (or you can push it), to this path
<location>-docker.pkg.dev/<ProjectId>/<RepositoryName>/<ImageName>