fix volumes with read-only rootfs

see containers/bubblewrap#413

d-run

@@ -28,7 +28,7 @@ def make_volume(path, dir):
 def build_cmd(dir, config):
 	cmd = [
 		'bwrap',
-		'--ro-bind', os.path.join(dir, 'rootfs'), '/',
+		'--bind', os.path.join(dir, 'rootfs'), '/',
 		'--tmpfs', '/tmp',
 		'--dev', '/dev',
 		'--proc', '/proc',
@@ -37,9 +37,6 @@ def build_cmd(dir, config):
 		'--die-with-parent',
 	]
 
-	if config.get('rw'):
-		cmd[1] = '--bind'
-
 	if config.get('Hostname'):
 		cmd += ['--hostname', config['Hostname']]
 	if config.get('WorkingDir'):
@@ -53,6 +50,9 @@ def build_cmd(dir, config):
 		for volume in config['Volumes']:
 			cmd += make_volume(volume, dir)
 
+	if not config.get('rw'):
+		cmd += ['--remount-ro', '/']
+
 	if config.get('net'):
 		cmd += [
 			'--ro-bind', '/etc/resolv.conf', '/etc/resolv.conf',