You can also do this without Docker. I do this as part of my build system (which is just a bash script) for a Linux distribution. Each package has a download phase, which permits network access. After that phase completes, network access is dropped.

https://chiselapp.com/user/rkeene/repository/bash-drop-netwo...