A computer system has a runtime environment (e.g. Java) and a deployment unit (e.g. in a Spring framework layer) arranged to deploy the application into the runtime environment. The application comprises bundles (e.g. OSGi bundles) with manifest metadata having export statements defining exported packages. The deployment unit comprises a receiver unit to receive the bundles, an extractor unit to examine the metadata and extract the export statements, a converter unit to convert each of the export statements into a corresponding import statement, and a creator unit to add a synthetic bundle having the import statements inserted in its metadata. The deployment unit sets a thread context class loader to delegate class loading to a class loader of the synthetic bundle. Thus, at runtime, classes of the application are only loaded when they are explicitly exported packages as defined by the synthetic bundle.