On: AWS pre-announces public container image registry

[myroon5]

Something like IAM seems necessary to authorize fork PRs to pull from but not push to registries:

https://github.com/GoogleContainerTools/skaffold/issues/4432

in order to rate limit unauthenticated pulls:

https://docs.docker.com/docker-hub/download-rate-limit/