Incus , set security.privileged=false failed on remapping filesystem

I have an old container (blackfyre-ori), Centos 7 - CPanel, that’s been running with security.privileged=true and now I want to set it to security.privileged=false
storage backend: zfs.
so, stop the container, config set, then start it.
remapping filesystem failed like this :

Error: Failed to handle idmapped storage: Failed to change ownership of: /var/lib/incus/storage-pools/1-hdpool/containers/blackfyre-ori/rootfs/usr/local/cpanel/logs/cpdavd_error_log
Try incus info --show-log blackfyre-ori for more info

seems like ownership mapping problem but I still can’t figure it out.

ls -nla on that dir in the container :

[root@blackfyreori ~]# ls -nlah /usr/local/cpanel/logs/
total 8.1M
drwx–x–x 6 2000000 2000000 28 Dec 4 00:28 .
drwx–x–x 41 2000000 2000010 74 Dec 6 10:33 …
-rw------- 1 2000000 2000000 3.7M Dec 6 17:00 access_log
-rw------- 1 2000000 2000000 8.8K Sep 28 2022 api_tokens_log
drwx------ 2 2000000 2000000 76 Dec 4 00:28 archive
-rw------- 1 2000000 2000000 409K Dec 6 01:02 build_locale_databases_log
-rw------- 1 2000000 2000000 0 May 28 2019 cpbackup_transport_history.log
-rw------- 1 0 0 716K Dec 6 16:08 cpdavd_error_log
-rw------- 1 0 0 5.4M Dec 6 15:12 cpdavd_session_log
-rw------- 1 0 0 4.6M Dec 6 16:09 cpgreylistd.log
-rw------- 1 0 0 554K Feb 8 2022 cphulkd.log
-rw------- 1 0 0 705K Feb 8 2022 cphulkd_errors.log
-rw------- 1 0 0 5.1M Dec 6 03:19 cpwrapd_log
-rw------- 1 0 0 663K Dec 6 04:58 dnsadmin_log

/etc/subuid and /etc/subgid on host :

root@dcx02:~# cat /etc/subuid
alice:100000:65536
bob:165536:65536
charlie:231072:65536
root:1000000:1000000000

root@dcx02:~# cat /etc/subgid
alice:100000:65536
bob:165536:65536
charlie:231072:65536
root:1000000:1000000000

thanks for any help