1. A method performed on a server that is part of a network, the server having space representing excess capacity, a Host IP address and at least one legacy application running in a legacy container thereon, the method comprising: using a custom shared library, in response to a request to run a new application in a new container, creating the new container on the server hosting the legacy container with the space representing the excess capacity, installing the new application in the new container, intercepting a port discovery system call from the new application, and assigning a non-routable IP address pair to the new container; using a DNAT forwarding rule of the shared library, for each port the new application intends to listen on, to handle routing of packets directed to the new application; and using at least one NAT masquerade rule to modify packets sent by the new application onto the network so that network traffic from the new application will appear as if it is coming from the Host IP address, so that the new application in the new container will run in the space that was the excess capacity prior to creation of the new container on the server independent of the legacy application and neither the new application nor the legacy application will interfere with each other.