Isolating an application running inside a native container application

At a computing device having native device capabilities, a computer implemented method of limiting access to native device capabilities, the method comprising:

• executing a container application installed at the computer system, the container application comprising a central portal, the central portal including information correlating a hosted application with a limited set of capabilities from among the native device capabilities, and the container application configured to:
• obtain from the central portal the information identifying the limited set of capabilities from among the native device capabilities;
• create a hosting manager, the hosting manager implemented completely within a native context of the device, and provide the information identifying the limited set of capabilities to the hosting manager;
• the container application preventing the hosted application from directly accessing any of the native device capabilities;
• provide access to the hosted application to the limited set of capabilities obtained from the central portal, using a transport layer between the container application and the hosted application which provides a connection between the native context associated with the container application and a hosted application context, the hosted application communicating with the limited set of capabilities through one or more plugins and the hosting manager, each plugin having a container part executing within the container application and an outside part executing within the native context, such that the hosted application can communicate with the limited set of capabilities through the hosting manager;
• and
• executing the hosted application and enforce limits on the hosted application such that the hosted application is able to access only the native device capabilities identified in the limited set of capabilities.

A computing device comprising:

• one or more cameras;
• one or more microphones;
• one or more pieces of communication hardware;
• one or more pieces of location hardware;
• a file system;
• a container application coupled to the one or more cameras, one or more microphones, one or more pieces of communication hardware, one or more pieces of location hardware and the file system, the container application coupled with a central portal comprising information correlating a hosted application with a limited set of capabilities among native device capabilities of the device, wherein the container application is configured to access device capabilities associated with the one or more cameras, one or more microphones, one or more pieces of communication hardware, one or more pieces of location hardware and the file system;
• and
• the hosted application configured to be executed by the container application, wherein the container application is configured to:
• obtain from the central portal the information identifying the limited set of capabilities from among the native device capabilities;
• create a hosting manager, the hosting manager implemented completely within a native context of the device, and provide information identifying the computing device capabilities to the hosting manager;
• the container application preventing the hosted application from directly accessing any of the native device capabilities;
• provide access to the hosted application to the limited set of capabilities obtained from the central portal, using a transport layer between the container application and the hosted application which provides a connection between the native context associated with the container application and a hosted application context, the hosted application communicating with the limited set of capabilities through one or more plugins and the hosting manager, each plugin having a container part executing within the container application and an outside part executing within the native context, such that the hosted application can communicate with the limited set of capabilities through the hosting manager;
• and
• limit capabilities associated with the one or more cameras, one or more microphones, one or more pieces of communication hardware, one or more pieces of location hardware and the file system to the hosted application even when the hosted application includes functionality for accessing capabilities from which t it is limited.