feat(mega-linter-runner): support Apple's native container engine on macOS

[snaquekiller]

Proposed Changes

1. Add container to --container-engine (docker/podman/container) to run MegaLinter with Apple's native container CLI on Apple Silicon (macOS 15+), without Docker Desktop: https://github.com/apple/container
2. Branch pull/inspect/logs per engine, since Apple's container CLI is not docker-CLI-compatible:
   • image pull / image inspect live under the image subcommand (there is no bare pull/inspect)
   • image inspect is JSON-only (no --format Go template) - parsed for a matching variants[].platform.{os,architecture} to keep the "skip pull for pinned versions already available locally" optimization
   • logs uses -n <n> instead of --tail <n>
3. Update README and CHANGELOG, add unit tests for CLI parsing and for the --timeout cleanup path with --container-engine container

Related to #1160 (podman engine request) - this adds a third engine option for Apple Silicon users who don't want Docker Desktop.

Readiness Checklist

Author/Contributor

• Add entry to the CHANGELOG listing the change
• Documentation updated (README)

[nvuillam]

@snaquekiller looks good, thanks for the PR :)
Did you check locally with npm link from your local MegaLinter repo ?

[echoix]

Looks generally fine, I'm disappointed that Apple took such a generic name, but it's really the name used throughout the project's GitHub page.

[snaquekiller]

Yes, just did — this Mac is Apple Silicon with container v1.4.1 already installed and running (container system status).

npm link from the branch, then:

mega-linter-runner --linter PYTHON_RUFF --container-engine container --platform linux/arm64 --path . sample.py

Real pull of ghcr.io/oxsecurity/megalinter-only-python_ruff:latest via container image pull (28 blobs, ~102MB, unpacked for linux/arm64), then container run started the container, MegaLinter ran, ruff correctly flagged the unused import os in my test file, SARIF report was written to megalinter-reports/python_ruff/. --rm cleaned it up — container list --all showed nothing left afterward.

So the full path (pull → run → cleanup) works end-to-end against the real container engine, not just the mocked unit tests.

[snaquekiller]

Like you suppose i have done everything with AI. i try to do it as clean as possible . i check myself if it's seem ok. For me i didn't saw anything miss. Feel free if you saw anything wrong :) . Im more happy to help and do better.

[nvuillam]

@snaquekiller that's ok to do everything in AI, there is kind of 1 year i've not written a single line of code :)

What makes the differences are the harness around (megalinter has one, starts with /analyze), and how to developer drives the AI and reviews what has been generated :)

[nvuillam]

@snaquekiller now available with mega-linter-runner@beta :)

[snaquekiller]

tested on my way this morning work well. thanks :) <3

[nvuillam]

Great, thanks for the feedback 😊