<p>Yes, it's possible. Fundamentally GCR is built on top of Cloud Storage, with roughly the same basic access control:</p>

<ul>
<li>public, i.e completely accessible</li>
<li>private, with quite flexible access control from pretty much anywhere, even from outside the GCP domain - being in a certain GCP project is rather irrelevant.</li>
</ul>

<p>From <a href="https://cloud.google.com/container-registry/docs/access-control#granting_users_and_other_projects_access_to_a_registry" rel="nofollow noreferrer">Granting users and other projects access to a registry</a>:</p>

<blockquote>
  <p>To give specific users or container clusters running on other projects
  permissions to pull images from a registry, you need to grant read
  permission on the underlying Cloud Storage bucket.</p>
  
  <p>...</p>
  
  <ol start="4">
  <li>Select the <strong>Permissions</strong> tab.</li>
  <li>Click <strong>Add members</strong>.</li>
  <li><p>From the menu that appears, fill the <strong>Members</strong> field with the email addresses of users needing read permission, separated by commas.
  This email address can be one of the following:</p>
  
  <ul>
  <li>a Google account (for example, <code>someone@example.com</code>)</li>
  <li>a Cloud IAM service account</li>
  <li>the <a href="https://cloud.google.com/compute/docs/access/service-accounts#compute_engine_default_service_account" rel="nofollow noreferrer">Compute Engine default service account</a> of another project. This account is used by the Google Kubernetes Engine to pull
  container images clusters by default. It is in the form
  <code>[PROJECT_NUMBER]-compute@developer.gserviceaccount.com</code>, where
  <code>[PROJECT-NUMBER]</code> is the <a href="https://cloud.google.com/resource-manager/docs/creating-managing-projects#identifying_projects" rel="nofollow noreferrer">GCP project number</a> of the project that
  is running the Google Kubernetes Engine cluster.</li>
  </ul></li>
  </ol>
</blockquote>

<p>There are some differences from Cloud Storage, most notable ones being:</p>

<ul>
<li>access control applies to the bucket level only, object level access is ignored</li>
<li>GCR can only have a single bucket per GCP project</li>
</ul>

CC BY-SA 4.0
2019-03-16T03:24:05.433Z
2019-03-16T03:24:05.433Z
Dan Cornilescu
<p>Is it possible to pull images from the same <code>GCR</code> from multiple <code>GCP</code> projects without making the registry public?</p>

<p>I want to do this so I do not have to upload multiple times the same image to multiple registries so it can be used on different projects.</p>

<docker><gcp>
Google Cloud Registry and multiple projects
Navarro
# Google Cloud Registry and multiple projects

(Asked by: username_0 on 2019-03-15)

Is it possible to pull images from the same `GCR` from multiple `GCP` projects without making the registry public?

I want to do this so I do not have to upload multiple times the same image to multiple registries so it can be used on different projects.

**Tags:** docker, gcp


---

## 1 answers

### Answer by username_1 on 2019-03-16. Score: 3 | Accepted answer

Yes, it's possible. Fundamentally GCR is built on top of Cloud Storage, with roughly the same basic access control:

* public, i.e completely accessible
* private, with quite flexible access control from pretty much anywhere, even from outside the GCP domain - being in a certain GCP project is rather irrelevant.

From [Granting users and other projects access to a registry](https://cloud.google.com/container-registry/docs/access-control#granting_users_and_other_projects_access_to_a_registry):

> To give specific users or container clusters running on other projects
> permissions to pull images from a registry, you need to grant read
> permission on the underlying Cloud Storage bucket.
>
> ...
>
> 4. Select the **Permissions** tab.
> 5. Click **Add members**.
> 6. From the menu that appears, fill the **Members** field with the email addresses of users needing read permission, separated by commas.
>    This email address can be one of the following:
>
>    * a Google account (for example, `someone@example.com`)
>    * a Cloud IAM service account
>    * the [Compute Engine default service account](https://cloud.google.com/compute/docs/access/service-accounts#compute_engine_default_service_account) of another project. This account is used by the Google Kubernetes Engine to pull
>      container images clusters by default. It is in the form
>      `[PROJECT_NUMBER]-compute@developer.gserviceaccount.com`, where
>      `[PROJECT-NUMBER]` is the [GCP project number](https://cloud.google.com/resource-manager/docs/creating-managing-projects#identifying_projects) of the project that
>      is running the Google Kubernetes Engine cluster.

There are some differences from Cloud Storage, most notable ones being:

* access control applies to the bucket level only, object level access is ignored
* GCR can only have a single bucket per GCP project


---

