How to provide access to a specific image in gcloud gcr.io?

Question

I have created docker image with name us.gcr.io/my-project/my-image and I want to create service account which will have permission to pull & push only this specific docker image.

https://cloud.google.com/container-registry/docs/access-control

As I understood I need to provide access to the whole bucket where all images are stored. Is it possible to set up permissions on specific image without creating a new google project (the only way i see now)?

Answer 1

You can't do it directly with Google Container Registry. If you provide the Storage object viewer role to a service account, it can see all the images in all your container registry.

However, you can do it with Artifact repository. For this

• Create a new repository
• Select your repository and click sur add member
• Add your service account and grand the role Artifact Repository Reader

Then you can access to your image (or you can push it), to this path

<location>-docker.pkg.dev/<ProjectId>/<RepositoryName>/<ImageName>