Methods and systems for mutating a network topology on which various containers run. The system includes a host controller to assign each of a plurality of hosts an unchanging public virtual IP address that maps to changing real IP address, a threat detection module to detect a mutation stimuli, and a management module configured to receive a mutation policy and execute the mutation policy to enact a container mutation upon the threat detection module detecting the mutation stimuli.