You dont cut all network just decide what you allow to pierce.

For files it has an isolated file system. That can have a git clone.