coreos-base/oem-gce: allow container to mess with /sys and /proc/irq

The container performs multi-queue optimizations for ssd and network devices
which requires touching /proc and /sys/ mounts which systemd-nspawn usually
mounts readonly. Allow the container to modify those by setting the appropriate
environment variable (found via https://systemd.io/ENVIRONMENT/).

sdk_container/src/third_party/coreos-overlay/coreos-base/oem-gce/files/units/oem-gce.service

@@ -21,6 +21,8 @@ ExecStartPre=-/usr/bin/umount /var/lib/flatcar-oem-gce.img
 ExecStartPre=/usr/bin/mount /var/lib/flatcar-oem-gce.img /var/lib/flatcar-oem-gce
 ExecStartPre=/usr/bin/tar --directory=/var/lib/flatcar-oem-gce --extract --file=/usr/share/oem/flatcar-oem-gce.aci --strip-components=1 rootfs
 ExecStartPre=/usr/bin/umount /var/lib/flatcar-oem-gce.img
+# the container expects to be able to optmize irq settings in /proc/irq and /sys/
+Environment=SYSTEMD_NSPAWN_API_VFS_WRITABLE=1
 ExecStart=/usr/bin/systemd-nspawn --keep-unit --register=no --link-journal=no \
     --machine=oem-gce --capability=CAP_NET_ADMIN --bind=/dev/log --bind=/run/systemd --tmpfs=/run/lock --bind=/etc --bind=/home --bind-ro=/usr/share/google-oslogin/nsswitch.conf \
     --read-only --volatile=overlay --image=/var/lib/flatcar-oem-gce.img /init.sh