In one example, resilient software application upgrades in a virtual datacenter is disclosed, in which network flow data is periodically obtained between a plurality of APPVMs and/or containers and deep packet inspection information from firewalls associated with the obtained network flow data in the virtual datacenter. Dependency relationships between the plurality of APPVMs and/or containers are then obtained based on the periodically obtained network flow data, the periodically obtained deep packet inspection information, and a network flow criteria. An upgrade that is about to happen to a software residing in one or more of the plurality of APPVMs and/or containers is determined. One or more of the plurality of APPVMs and/or containers affected by the software upgrade is determined based on the determined dependency relationships. Snapshots of the affected one or more of the plurality of APPVMs and/or containers are then obtained before initiating the software upgrade.