I would like to also suggest greywall[1] which i found yesterday. It sandboxes the filesystem, network, syscalls, dns. The network uses a transparent proxy to see which network requests were made. Supports linux and macos.

[1] https://github.com/GreyhavenHQ/greywall