1. A method, comprising: examining, by a managed container embodied on non-transitory computer memory and operating on a client device, a communication received from an application gateway server computer communicatively connected to the managed container over a network, the managed container comprising a managed cache; determining, by the managed container based at least on the communication received from the application gateway server computer, that a first application is to be downloaded into the managed cache of the managed container on the client device; downloading into the managed cache, by the managed container, a client application package associated with the application from the application gateway server computer; extracting, by the managed container, the client application package associated with the first application into the managed cache, the client application package containing a user interface component of the first application, the user interface component comprising an icon for the first application; and displaying, by the managed container, the icon for the first application on a user interface of the managed container, the managed container configured for providing a secure runtime shell within which the first application is run when invoked via the icon for the first application displayed on the user interface of the managed container; wherein the managed container is one of a plurality of managed containers executing on client devices and a plurality of corresponding protected caches, each protected cache including a data cache, a state cache, and a synchronization cache, the enterprise information stored in the data cache, wherein the application gateway server computer controls a common state of each enterprise application on each client device by enabling download of state information to the state caches, and the application gateway server computer controls synchronization of the enterprise information into the data caches based on the common state.