Can we isolate builds from the network? Like bazel sandboxes can do.