A computer-implemented method of managing application interaction on a device using containers, the computer-implemented method being performed by one or more processors executing computer executable instructions for the computer-implemented method, and the computer-implemented method comprising: for a set of applications on a device, based on certain conditions, determining a plurality of container groups, where each container group defines a set of applications and a set of interactions parameters defining boundaries of interactions between the applications for the applications in the container group, wherein applications within a given container are allowed to interact with each other in certain ways as defined by the parameters for the given container; identifying one or more changes in the certain conditions; and as a result of identifying one or more changes in the certain conditions changing membership in the container groups, comprising dynamically placing applications in different containers; wherein the change in certain conditions comprise factors related to one or more of: installation of an application; removal of an application; change in policy; an application update; an application action; identity switching; geo-fencing; time fencing; network changes; or change in device compliance state and wherein the certain condition comprises factors related to installation source for an application; wherein the boundaries of interactions between the applications comprise at least one of allowing sharing encryption for a dataset, restricting access to certain data, and restricting certain interactions. for a set of applications on a device, based on certain conditions, determining a plurality of container groups, where each container group defines a set of applications and a set of interactions parameters defining boundaries of interactions between the applications for the applications in the container group, wherein applications within a given container are allowed to interact with each other in certain ways as defined by the parameters for the given container; identifying one or more changes in the certain conditions; and as a result of identifying one or more changes in the certain conditions changing membership in the container groups, comprising dynamically placing applications in different containers; wherein the change in certain conditions comprise factors related to one or more of: installation of an application; removal of an application; change in policy; an application update; an application action; identity switching; geo-fencing; time fencing; network changes; or change in device compliance state and wherein the certain condition comprises factors related to installation source for an application; wherein the boundaries of interactions between the applications comprise at least one of allowing sharing encryption for a dataset, restricting access to certain data, and restricting certain interactions. installation of an application; removal of an application; change in policy; an application update; an application action; identity switching; geo-fencing; time fencing; network changes; or change in device compliance state and wherein the certain condition comprises factors related to installation source for an application; wherein the boundaries of interactions between the applications comprise at least one of allowing sharing encryption for a dataset, restricting access to certain data, and restricting certain interactions. <EOS>