You’d need to have root:1000:1 in both /etc/subuid and /etc/subgid for this to be allowed, do you have that?
root:1000:1