@thedarktangent The only sandboxing tool that I am aware of which is capable of egress filtering based on DNS name is NoNo
https://nono.sh/docs/cli/features/networking