Add --read-only-path and --masked-path option to container run / create

Add --read-only-path and --masked-path option to container run / create #2652