Idea: add network limits

[cjrh]

A key one is to prevent network access completely. But there could be something more fine-grained like controlling specific domains etc.

[cjrh]

Also, only allow the wrapped process to expose certain ports, or only allow it to connect to other specific ports? (thinking along the lines of docker here)