By default, you are not able to pull images from your private registry on you Container Optimized OS (COS) VMs. If you ran command like docker pull gcr.io/xxx/xxx, you will see error message:

Error response from daemon: unauthorized: You don't have the needed permissions
to perform this operation, and you may have invalid credentials.
To authenticate your request, follow the steps in:
https://cloud.google.com/container-registry/docs/advanced-authentication

You should run the command below to configure docker.

docker-credential-gcr configure-docker

See doc section: Standalone Docker credential helper.

At this time, cat your ~/.docker/config.json, you should see content like this:

{
  "auths": {},
  "credHelpers": {
    "asia.gcr.io": "gcr",
    "eu.gcr.io": "gcr",
    "gcr.io": "gcr",
    "staging-k8s.gcr.io": "gcr",
    "us.gcr.io": "gcr"
  }
}