Your specific error is:

=> ERROR [internal] load metadata for docker.io/library/demo:f  1.4s
[...]
ERROR: failed to solve: pull access denied, repository does not exist or may require authorization: server message: insufficient_scope: authorization failed

You don't actually have a demo:focal image in your docker local image cache is what this means, you probably named it something slightly different.

VSCode just uses docker (based on your VSCode settings configuration apparently) to implicitly build an image here, so it's temporarily constructing a Dockerfile that starts with FROM ${image} and then passing it to docker buildx build.

What you're seeing is docker checking the local image cache for demo:focal, not finding an image with that exact name and version, using the fallback behavior for image names that don't start with a URL+path and adding the default docker.io/library/ to the name, still not finding docker.io/library/demo:focal in the local image cache, and then trying to get the image from the registry since it's missing from the local image cache. Since your image name didn't have a registry URL, which is required to be able to pull, it uses the built-in fallback behavior and adds docker.io/library/ and then tries to pull from docker.io/library/demo:focal.

Apparently the docker.io registry is returning an "access denied" error if you try to do a docker pull docker.io/library/demo:focal.

So to fix this, you need to:

1. Have the image you want already in your docker local image cache (shows up with the exact same name in docker image ls results)
2. Use the identical matching name in your devcontainer.json for the "image" field.