Remove state_dir from setMountsMap

The setMountsMap command required the state_dir argument, presumably
so that the zuul ansible path (ie, our custom modules) is available.

Unfortunately, it set it as a read-write bind, not read-only.  We
certainly don't want jobs (even trusted jobs) modifying the ansible
code that we run.

Switch it to a read-only bind mount.

Also, remove it from special handling inside of the setMountsMap
method and instead, handle it on the executor site for increased
visibility.

Finally, add options to the zuul-bwrap command to set the ro and
rw binds to make interactive testing easier.

Change-Id: I4a0fdae546a2307d78a5c29b5a62a6d223ecb9e9

zuul/driver/bubblewrap/__init__.py

@@ -81,8 +81,8 @@ class BubblewrapDriver(Driver, WrapperInterface):
     def stop(self):
         pass
 
-    def setMountsMap(self, state_dir, ro_dirs=[], rw_dirs=[]):
-        self.mounts_map = {'ro': ro_dirs, 'rw': [state_dir] + rw_dirs}
+    def setMountsMap(self, ro_dirs=[], rw_dirs=[]):
+        self.mounts_map = {'ro': ro_dirs, 'rw': [] + rw_dirs}
 
     def getPopen(self, **kwargs):
         # Set zuul_dir if it was not passed in
@@ -180,12 +180,16 @@ def main(args=None):
     driver = BubblewrapDriver()
 
     parser = argparse.ArgumentParser()
+    parser.add_argument('--ro-bind', nargs='+')
+    parser.add_argument('--rw-bind', nargs='+')
     parser.add_argument('work_dir')
     parser.add_argument('run_args', nargs='+')
     cli_args = parser.parse_args()
 
     ssh_auth_sock = os.environ.get('SSH_AUTH_SOCK')
 
+    driver.setMountsMap(cli_args.ro_bind, cli_args.rw_bind)
+
     popen = driver.getPopen(work_dir=cli_args.work_dir,
                             ssh_auth_sock=ssh_auth_sock)
     x = popen(cli_args.run_args)