When false, bwrap uses --unshare-net and seccomp can monitor socket syscalls; when true, network is allowed.