Install the suspicious package in a box that can't call home

A dependency bumped a minor version and its postinstall script grew by 400 lines. You want to know what it does before it runs on a developer's laptop.

You snapshot the dev container, clone it, and set the clone's network exit to block. The exit is applied on the host, so the postinstall can't route around it. You npm install in the clone's terminal. The script runs, tries to open a socket, fails, writes something into ~/.config. You snapshot again and compare: two new files, one modified shell profile.

You now know exactly what the package touched, on a machine that no longer exists, while your real dev box never ran it.

A sandbox service would have been a ticket and a budget line. Supply-chain review is a clone, a blocked route, and a diff.