Examples of techniques for detecting and tracking virtual containers are disclosed. In one example implementation according to aspects of the present disclosure, a computer-implemented method includes detecting a virtual container. The method further includes collecting virtual container data for the virtual container. The method also includes associating, by a processing device, the virtual container to at least one of a plurality of images. Additionally, the method includes building, by the processing device, a container event database based on the virtual container data and the association of the virtual container to the at least one of the plurality of images, so as to enable tracking of software in the plurality of images and in live virtual containers.