A method for managing application containers (220, 230) in a system, comprising: assigning a first application and a second application to a master container and a slave container, respectively, wherein the master and slave containers (220, 230) are implemented by respective container applications stored in a memory of the system and running on a same run-time process; using a processor of the system, assigning the master and slave containers (220, 230) to a container group by: delegating access to container meta-data requested by a container run-time of the slave container or by the second application to a container meta-data accessor of the master container via a class loader of the master container, wherein the container meta-data accessor of the master container is configured to allow access to container meta-data of the master container, and wherein delegating access includes the slave container receiving an instance of the container meta-data accessor of the master container whereby the container run-time of the slave container or the second application enforces security policies defined by the container meta-data of the master container; delegating interaction between the container run-time of the slave container and a container management channel of the slave container to a container management channel of the master container via the class loader of the master container, wherein delegating interaction includes the slave container receiving executable code that implements the container management channel of the master container; and accessing the first and second applications (224, 234) via the container group. assigning a first application and a second application to a master container and a slave container, respectively, wherein the master and slave containers (220, 230) are implemented by respective container applications stored in a memory of the system and running on a same run-time process; using a processor of the system, assigning the master and slave containers (220, 230) to a container group by: delegating access to container meta-data requested by a container run-time of the slave container or by the second application to a container meta-data accessor of the master container via a class loader of the master container, wherein the container meta-data accessor of the master container is configured to allow access to container meta-data of the master container, and wherein delegating access includes the slave container receiving an instance of the container meta-data accessor of the master container whereby the container run-time of the slave container or the second application enforces security policies defined by the container meta-data of the master container; delegating interaction between the container run-time of the slave container and a container management channel of the slave container to a container management channel of the master container via the class loader of the master container, wherein delegating interaction includes the slave container receiving executable code that implements the container management channel of the master container; and accessing the first and second applications (224, 234) via the container group. delegating access to container meta-data requested by a container run-time of the slave container or by the second application to a container meta-data accessor of the master container via a class loader of the master container, wherein the container meta-data accessor of the master container is configured to allow access to container meta-data of the master container, and wherein delegating access includes the slave container receiving an instance of the container meta-data accessor of the master container whereby the container run-time of the slave container or the second application enforces security policies defined by the container meta-data of the master container; delegating interaction between the container run-time of the slave container and a container management channel of the slave container to a container management channel of the master container via the class loader of the master container, wherein delegating interaction includes the slave container receiving executable code that implements the container management channel of the master container; and accessing the first and second applications (224, 234) via the container group.