The sandbox was already there, Rubydoc runs yard inside docker, the problem is that container still has network access

Presumably the docker container has network access because something else in the build system requires it? I don't think sandboxing the entire build process is the right level of granularity here - one ideally wants to be able sandbox each package's build scripts individually.

So, not a sandbox then.