* Jakub Wilk <jwilk@debian.org>, 2016-09-07, 23:49:
you can completely disable external network with socket_wrapper
... which is a pretty heavy-weight solution, and in fact it breaks asyncssh's tests.
Luckily, glibc has a way to disable DNS queries without LD_PRELOAD trickery:
$ RES_OPTIONS=attempts:0 wget http://www.example.com/
--2016-09-29 22:49:22-- http://www.example.com/
Resolving www.example.com (www.example.com)... failed: Temporary failure in name resolution.
wget: unable to resolve host address ‘www.example.com’