Do no match against docker label
This was allowing custom images to be run even when "allow custom images"
was unchecked if the custom image matched an image name in the labeled image
list.