mkdir -p /media/restricted/joe/somedisk
chown joe /media/restricted/joe/somedisk
chmod 700 /media/restricted/joe/somedisk
mount /dev/sdz42 /media/restricted/joe/somedisk

bindfs -o perms=a-w /media/private/somedisk /media/public-read-only/somedisk

mount -t vfat -o umask=0022,gid=33,uid=33 dev /var/www