Recovery of state, configuration, and content for virtualized instances

1 . A non-transitory computer-readable medium including instructions that, when executed by at least one processor, cause the at least one processor to perform operations for analysis of data associated with software instances, the operations comprising:

obtaining data associated with a software instance;

archiving, in at least one data storage system, delta data associated with the software instance, the delta data representing a plurality of differences between a first state of the data associated with the software instance and a second state of the data associated with the software instance, wherein the plurality of differences are based on a plurality of operations performed on at least one of the data associated with the software instance or the software instance;

analyzing one or more previous states of the software instance by simulating the one or more previous states of the software instance based on the archived delta data; and

performing a security action based on the analysis of the one or more previous states of the software instance based on the archived delta data.

2 . The non-transitory computer-readable medium of claim 1 , wherein the software instance is represented in a continuous development or continuous deployment pipeline prior to deployment of the software instance.

3 . The non-transitory computer-readable medium of claim 1 , wherein the archived delta data is stored in at least one data storage system in association with time information indicating when the plurality of operations were performed.

4 . The non-transitory computer-readable medium of claim 1 , wherein the software instance is a software container.

5 . The non-transitory computer-readable medium of claim 1 , wherein the operations further comprise archiving state data associated with the second state of the data associated with the software instance.

6 . The non-transitory computer-readable medium of claim 1 ,

wherein the simulating further comprises simulation in a sandbox environment.

7 . The non-transitory computer-readable medium of claim 1 , wherein the security action comprises at least one of: an alert, a report, a blocking of an action, or a permission of an action.

8 . The non-transitory computer-readable medium of claim 1 , wherein the security action is performed automatically.

9 . The non-transitory computer-readable medium of claim 1 , wherein the operations further comprise:

deallocating the software instance; and

accessing archived delta data associated with the deallocated software instance.

10 . The non-transitory computer-readable medium of claim 9 , wherein the operations further comprise:

reinstantiating the deallocated software instance based on the associated archived delta data; and

performing an audit on the reinstantiated software instance.

11 . The non-transitory computer-readable medium of claim 1 , further comprising continually archiving the delta data upon identification of a state change for the software instance.

12 . A computer-implemented method for enabling storage and analysis of data associated with software instances, the operations comprising:

obtaining data associated with a software instance;

archiving, in at least one data storage system, delta data associated with the software instance, the delta data representing a plurality of differences between a first state of the data associated with the software instance and a second state of the data associated with the software instance, wherein the plurality of differences are based on a plurality of operations performed on at least one of the data associated with the software instance or the software instance;

analyzing one or more previous states of the software instance by simulating the one or more previous states of the software instance based on the archived delta data; and

performing a security action based on the analysis of the one or more previous states of the software instance based on the archived delta data.

13 . The computer-implemented method of claim 12 , wherein the archiving further comprises compressing the plurality of differences between the first state of the data associated with the software instance and the second state of the data associated with the software instance into a chain of activities.

14 . The computer-implemented method of claim 13 , wherein the operations further comprise archiving multiple versions of the chain of activities, each version being associated with a different state of the data associated with the software instance.

15 . The computer-implemented method of claim 12 , wherein the plurality of differences between the first state of the data associated with the software instance and the second state of the data associated with the software instance comprise at least one of: image information associated with the software instance, memory contents associated with the software instance, or configuration information associated with the software instance.

16 . The computer-implemented method of claim 15 , wherein the configuration information comprises one or more parameters of the software instance.

17 . The computer-implemented method of claim 12 , wherein the security action comprises performing an audit of the software instance.

18 . The computer-implemented method of claim 12 , wherein the archiving is performed on a periodic basis.

19 . The computer-implemented method of claim 12 , further comprising continually archiving the delta data upon identification of a state change for the software instance.

20 . The computer-implemented method of claim 12 , further comprising performing an iterative security action on each of a plurality of sets of delta data associated with the software instance.