The GitHub Container Registry 29 (ghcr.io) stores images as ghcr.io/<owner>/<image>, next to the code that built them. GitHub 29 's billing documentation says its storage and bandwidth are "currently free", with at least a month's notice before that changes. A package published from a workflow is linked to its repository and inherits its access, so BookNest's public repository yields a public image that anyone can pull anonymously.
Outside GitHub Actions 29 , docker login ghcr.io accepts only a personal access token (classic) with the write:packages scope, as in echo "$CR_PAT" | docker login ghcr.io -u <username> --password-stdin; fine-grained tokens are not supported. This book's account has no classic token, so that login is not run here. Inside Actions, each run receives a short-lived GITHUB_TOKEN; with permissions: packages: write it can push to its own repository's packages. Nothing is stored or rotated, and the token expires with the job.