u/Individual_Building6

I'm trying to pull images from ghcr on local (later to be on server) but I keep hiting a permission problems.

I've already tried classic tokens and fine grained, the end result is allways the same, and i'm trying to understand what permission or configuration am I missing (probably on gh).

What works:

GET /repos/myorg/project1 -> 200 OK

Token can fully read repository metadata.

What fails:

GET /orgs/myorg/packages/container/project1 -> 403 Forbidden

On server/local machine

docker login ghcr.io -u $USERNAME --password $TOKEN
# Login Succeeded

docker pull ghcr.io/myorg/project1:tag
# 403 Forbidden

Q:

Anyone running a setup like this in production?
Org repos publishing to GHCR and pulling those images from outside the GitHub ecosystem (servers/CI/Docker hosts)?
Would appreciate a working example of how you handle auth/permissions.

Update for people with the same problem:

I found this discussion:

https://github.com/orgs/community/discussions/76914

It pointed to org setting blocking acess of classic tokens.

Org -> Settings -> PAT