> if you don't supply write-level GitHub credentials to the container (and you shouldn't!)

Really? What if your application needs to write to Github?