This is a signal to crunch-run that it is ok to bind mount over `/keep` (and therefore it is ok to implement the mounting of all subdirectories of `/keep` within a single docker bind mount). This mechanism was suggested by Tom Clegg as a simpler alternative to what I proposed. This is a part of the fix to https://dev.arvados.org/issues/13636 - the other part (of our implementation, which is working) is a revised crunch-run which uses the `bindmapfuse` ( https://github.com/wtsi-hgi/bindmapfuse) fuse filesystem to provide limited access to the underlying `arv-mount` filesystem. I.e. we use the `bindmapfuse` configuration rather than docker bind mounts to limit which portions of `/keep` are accessible to the container. The reason for the empty mount at `/keep` is that without that, it wouldn't necessarily be safe for crunch-run to decide on its own to bind mount `/keep` (i.e. because perhaps the container has some other contents under that directory that it needs to be able to see in addition to the subdirectories that are bind mounted in).

It shouldn't be harmful without the crunch-run changes, so long as the container doesn't have contents in `/keep`. The only side effect with the current crunch-run would be that an empty collection would be explicitly bind mounted over `/keep` in the container, meaning that if there was anything under there it would be masked before the other more specific bind mounts were layered over it. That is really the purpose of it - to signal to crunch-run that it is ok to make that entire tree into a single bind mount. The original plan in 13636 was to do that by adding functionality to arv-mount to allow specifying specific locator paths to expose, but I am not familiar enough with that codebase to make those changes quickly and was able to create a standalone fuse filesystem to do it in its own layer, at least as a proof of concept. If you are interested, the crunch-run changes that make use of the `/keep` empty collection mount (and that we are currently running with) are in: master...wtsi-hgi:13636-crunch-run-bindmapfuse