Create a non-privleged user. Restrict the account r/w to certain directories. Run the app as that user.

Want to only allow access to a whitelist of hosts? No dice.

I have not done this, but I think you can do that with iptables.