Abstract: A method for securely executing control applications via software-implemented containers which are each loadable into a container runtime environment set up on a host and are executable there, wherein a check component of the respective host calculates a respective check identifier via host-specific features and via features of the respective control application, where the check identifier and an initial application certificate of the control application are communicated to a registration component, the registration component verifies the check identifier and the initial application certificate and, in cases of a positive verification result, creates a device configuration certificate and an application instance certificate and communicates them to the host, linking of the application instance certificate with the control application is authorized via the device configuration certificate, and where execution of the container providing the control application on the host is authorized by the application instan