1. A method, comprising: prior to execution of a program comprising an application in a virtual container, recording a set of files accessed during a phase change of the application on a physical read-only storage medium in a manner predetermined to minimize the time needed to retrieve the set of files when the files are retrieved from the physical read-only storage medium during the execution of the application in the virtual container; and in response to the execution of the application in the virtual container, permitting one of: (i) accessing the physical read-only storage medium and retrieving the set of files, or (ii) allowing an operating system to access the physical read-only storage medium and retrieve the set of files as needed by the application, the accessing or allowing occurring at one of: an occurrence of the phase change, or when the files are prefetched, prior to the occurrence of the phase change, wherein the accessing or allowing occurs so that the files are retrieved from the physical read-only storage medium according to the manner predetermined to minimize the time needed to retrieve the set of files; during execution of the application in the virtual container, detecting with the virtual machine monitor an event comprising an occurrence of contemporaneous file accesses not associated with a known phase change, wherein detecting with the virtual machine monitor an event further comprises detecting contemporaneous file accesses originating from at least two processes within the virtual container or from at least one process within the virtual container and at least one process outside the container; and evaluating the event as a candidate phase change, wherein evaluating further comprises determining the contemporaneous file accesses originating from the at least two processes are related and determining the contemporaneous file accesses originating from the at least one process within the virtual container and the at least one process outside the container are not related, and using information about relationships of the contemporaneous file accesses in order to evaluate the contemporaneous file accesses as the candidate phase change.