Sandbox network isolation
Restrict outbound network access with domain allow/deny lists that take effect at the OS level.
{
"sandbox": {
"enabled": true,
"autoAllowBashIfSandboxed": true,
"network": {
"allowedDomains": ["github.com", "*.npmjs.org", "registry.yarnpkg.com"],
"deniedDomains": ["uploads.github.com", "sensitive.cloud.example.com"]
}
}
}