Effectively disable network access during the build
This starts a new network namespace without any connections to the
outside.
Bug: 122270019
Test: USE_GOMA=true m libc
Test: treehugger
Test: add rule to use /usr/bin/wget, fails after this change
Change-Id: Iba262025ce0e4e3bef5c34c817cc678d6c61403b
diff --git a/ui/build/sandbox_linux.go b/ui/build/sandbox_linux.go
index b87637f..f77eebb 100644
--- a/ui/build/sandbox_linux.go
+++ b/ui/build/sandbox_linux.go
@@ -143,9 +143,6 @@
// For now, just map everything. Eventually we should limit this, especially to make most things readonly.
"-B", "/",
- // Enable networking for now. TODO: remove
- "-N",
-
// Disable newcgroup for now, since it may require newer kernels
// TODO: try out cgroups
"--disable_clone_newcgroup",