before delving into the user permission possibility, just to doublecheck; is the custom image you are using bundling some version of metaflow in it as well? I'm wondering because the stack trace you are getting does point to metaflow internals, so at least some parts of it are accessible by the user.
is there a minimum reproducible dockerfile you could share for testing this out? I can take a look early next week.