The allow/deny rules for the warden container are specified the wrong way round. Fixing.