receiving, by the UE, a request to initialize an application on the UE;

querying, by the UE, a UE Route Selection Policy (URSP) stored on the UE based on the application;

in response to the querying, initiating, by a UE, an application within a virtualization container, wherein the virtualization container is bound to a network slice;

binding, by the UE, traffic for the application in the virtualization container to a protocol data unit (PDU) session; and

communicating, by the application executing within the virtualization container, with a core network over the PDU session via the network slice bound to the virtualization container, wherein a secure boundary is created via use of the virtualization container to prevent data leakage from the network slice to other network slices.