Support amd64 images on ARM64 hosts

[whiteov3rflow]

Summary

Add support for running the existing linux/amd64 Nihil images on ARM64 hosts such as Apple Silicon Macs.

The Docker daemon normally resolves the host platform when pulling an image. Since the current Nihil images are only published for linux/amd64, pulls fail on ARM64 with:

no matching manifest for linux/arm64/v8 in the manifest list entries

Changes

• Add get_image_platform() to select linux/amd64 on arm64 and aarch64 hosts.
• Pass the selected platform to the Docker image pull API.
• Pass the same platform when creating the container.
• Keep the existing Docker auto-detection behavior on amd64 and unknown architectures.
• Add unit tests for platform detection, image pulls, and container creation.

Runtime validation

Validated on an Apple Silicon Mac using OrbStack:

• Host: macOS arm64
• Docker engine: OrbStack
• Image: ghcr.io/thenullpigeons/full:latest (linux/amd64)
• Container creation and startup: successful
• Interactive command execution: successful
• Workspace mount: successful
• DNS and HTTPS connectivity: successful
• Tool execution: successful (nmap scan against 127.0.0.1)

Tests

111 passed in 0.12s

Additional checks:

• uv pip check
• git diff --check
• python -m compileall -q nihil tests
• Real container smoke test using the full image

Scope

This change does not introduce native ARM64 images. It allows ARM64 Docker engines with amd64 emulation support, such as OrbStack or Docker Desktop with Rosetta/QEMU, to pull and run the existing Nihil images.

[0xbbuddha]

Thanks for this, excellent first contribution. Tight scope, an explicit Scope section, runtime validation with evidence, and unit tests covering both arches. That's a better PR description than most of what we write ourselves. CI is green on 3.12 and 3.13, and I read through the diff, nothing to change. Merging.

Two notes, neither a request.

NIHIL_IMAGE_PLATFORM hardcodes linux/amd64 for every ARM host. That's exactly right today, but the day we publish native arm64 images it flips from a fix into a footgun, forcing emulation where native would work. Noting it here so it's written down, we'll revisit it on our side when that happens.

platform.machine() reports the Python interpreter's architecture rather than the Docker daemon's, so it returns x86_64 for a Python running under Rosetta, and it's wrong for a remote DOCKER_HOST. self.client.version().get("Arch") would be exact and matches how get_docker_engine(docker_client) already takes the client. Genuinely optional, platform.machine() covers the real-world case.

One thing outside your scope, just so it's recorded: nihil build still fails on ARM, since _cmd_build runs docker build without --platform and our base is FROM archlinux:latest, which is published amd64-only. I'm opening a follow-up issue. get_image_platform() already gives whatever takes it what it needs, so if you want the issue it's yours.

Thanks again, this is the kind of contribution that makes a project better to maintain.