Sadly tokens you use for Container Registry are full access tokens - they can also be used for everything else in the Digital Ocean API. I don't see why DO doesn't have scoped token support yet.