title: What are the minimum permissions/role for a service account required to read/write to Google Container Registry?
body: <p>I am trying to create a service role for a drone instance which builds and pushed a docker image to Google Container Registry. </p>
  
  <p>It works with the role <code>project&gt;owner</code> (presumably <code>project&gt;editor</code> would work too). I have not been able to find a way to restrict it only to have permission to push to GCR, or find out what the minimal permissions are. </p>
  
  <p><a href="https://i.stack.imgur.com/q2T0k.png" rel="noreferrer"><img src="https://i.stack.imgur.com/q2T0k.png" alt="Service account roles"></a></p>