Comment 6 for bug 1960858

We discussed this in our infrastructure call today. Dispatching push-capable credentials to builders is a non-starter for security reasons, but we could dispatch pull-only credentials if they existed (it would be some work to set up and we'd need to figure out exactly where to put them in the data model, but certainly less work than finishing the Harbor deployment). Does Docker Hub have any way to get pull-only credentials that would have the right sort of effects on rate limiting?