This message was deleted.

Apparently I needed to use

docker login <http://ghcr.io|ghcr.io> --username $USER --password $GITHUB_TOKEN

where

GITHUB_TOKEN

is a PAT w/ registry_read or something

yes, you must always authenticate with remote registries