I've launched the NGC image on a supported GCP instance but I can't pull down a NGC container

The NGC image expects that your GCP project will already have your SSH key. If your project does contain your SSH keys before launching and connecting to your VM instance, you will not be able to access the NGC container registry. In that case, you will need to either a) add yourself to the docker group after connecting to the instance, and then restart the session or b) delete the instance, add the SSH key to your project and start a new instance with the NGC image.

The Google Compute Engine generates and manages an SSH key automatically for logging into your instance (see the Google Cloud documentation Connecting to Instances at https://cloud.google.com/compute/docs/instances/connecting-to-instance ). However, to facilitate logging into the NGC container registry upon the initial connection to the VM instance, you need to generate your own SSH keys (see Creating a new SSH key for instructions - Choose an access method  |  Compute Engine Documentation  |  Google Cloud), and then add them to the metadata for your project (see Adding or Removing Project-Wide Public SSH Keys - アクセス方法を選択する  |  Compute Engine ドキュメント  |  Google Cloud).