They do have specific and read only token for the Container Registry.