Proposal: User containers should be mounted read-only

### This is a design-proposal for security hardening of the invoker.

During my work on AppArmor I did some research and found that it is currently very hard to enforce a disk size quota on docker containers. There are some discussions going on here https://github.com/docker/docker/issues/3804 and there is the `--device-write-bps` option in docker 1.10 which only limits throughput. We can't use docker 1.10 for stability reasons anyway.

**My proposal is this:**

To prevent any action container from flooding the host filesystem we mount the container in read-only mode. Each container will be given a writable `/tmp` directory that is mounted on a tmpfs volume with a small size (e.g. 512 MB, 1 GB etc.).

tmpfs is ramdisk so nothing gets written to the actual disk of the host (docker logs of course being a different issue).

I have been dabbling with `docker volume` but could not get it to actually create a real tmpfs volume with a size limit. The example for tmpfs [here](https://docs.docker.com/engine/reference/commandline/volume_create/) does not work.

Instead my proposal looks something like this:
1. when `makeContainer` gets called, the invoker first calls `makeTmpFs(containerName)`
2. makeTmpFs calls

```
tempDir = $(maketemp -d)
mount -t tmpfs -o size=512M,mode=0700 tmpfs $tempDir
```
3. `makeContainer` then starts the action container like so

```
docker run -d --read-only -v $tempDir:/tmp --security-stuff whisk/nodeJsAction
```
4. `rmContainer` finally does

```
umount $tempDir
```

Advantages:
1. Increased security. Containers can not flood the host.
2. Increased speed. Tmpfs is RAM, so super-fast. mount / umount takes next to no time.
3. We can really enforce a disk quota for actions.

Tradeoff we will have to make:
1. Actions can no longer write wherever they want in the container.
2. Blackbox implementers need to know. So the contract must be updated.

Once we can make the switch over to docker > 1.10 we can simply use the --tmpfs option of docker run and drop the above tmpfs handler in the invoker.