## Problem
Currently, even if `LAMBDA_REMOTE_DOCKER=1`, we unzip the zip files in the directory they are in, which is usually /var/lib/localstack, which usually has a bind mount to the host.
On docker desktop, due to the use of grpc-FUSE (on macos), this can be very slow, about 200 times slower than on volumes / directly on the host. With experimental virtio filesystem enabled (also on macos), this can be reduced to about 30 times as slow, but still problematic.
This means a lambda may take a lot of time processing, for each additional layer some more. This especially affects nodejs lambdas with huge node_modules folders.

## Probable solution
At least if `LAMBDA_REMOTE_DOCKER=1`, we should leave the initial zip files on the bind mount (for persistence etc), but the working directories after unzipping should be located on non-bind mounts, to speed up the IO for unzipping.
new_statement = generate_policy_statement(sid, action, arn, sourcearn, principal)
    policy = {
        "Version": IAM_POLICY_VERSION,
        "Id": "LambdaFuncAccess-%s" % sid,
        "Statement": [new_statement],
    }
    return policy
@app.route("%s/functions/<function>/policy" % API_PATH_ROOT, methods=["POST"])
def add_permission(function):
    arn = func_arn(function)
    qualifier = request.args.get("Qualifier")
    q_arn = func_qualifier(function, qualifier)
    result = add_permission_policy_statement(function, arn, q_arn, qualifier=qualifier)
    return result
def add_permission_policy_statement(
    resource_name, resource_arn, resource_arn_qualified, qualifier=None
):
    region = LambdaRegion.get()
    data = json.loads(to_str(request.data))