A method for updating an application on a host system includes steps or acts of: installing an application on the host system; installing a virtual machine monitor on the host system, installing a first virtual container on the host system, wherein the first virtual container comprises at least one update to the installed application; and instantiating the first virtual container under the virtual machine monitor in a mode wherein the host system can be accessed but not modified and wherein instantiating the first virtual container includes updating the installed application in the first virtual computer and running the updated application in the first virtual container. The method may also include a step of confirming that the updated application runs properly. Optionally, the virtual container may be devirtualized. A system for updating an application on a host system includes: at least one virtual machine monitor, at least one virtual container; at least one application; at least one update to the application contained within the at least one virtual container; and a processor configured for carrying out the above method steps. The system may also include an input multiplexer configured for mediating access to the at least one virtual container; and an output analyzer configured for confirming that the updated application performed as expected in at least one virtual container.