Support other container engines in contract verify.

Author: fnando

FULL_HELP_DOCS.md

@@ -369,6 +369,18 @@ To view the commands that will be executed, without executing them, use the --pr
 
 **Usage:** `stellar contract build [OPTIONS]`
 
+###### **Container Options:**
+
+- `-d`, `--docker-host <DOCKER_HOST>` — Optional argument to override the default docker host. This is useful when you are using a non-standard docker host path for your Docker-compatible container runtime, e.g. Docker Desktop defaults to $HOME/.docker/run/docker.sock instead of /var/run/docker.sock
+- `--engine <ENGINE>` — Container engine to use [default: docker]
+
+  Possible values:
+  - `docker`: Docker, or any Docker-compatible CLI
+  - `apple-container`: Apple's `container` CLI (macOS 26+, Apple silicon)
+
+- `--cpus <CPUS>` — Limit the number of CPUs available to the container, e.g. `2`. A whole number: Apple's `container` engine does not accept fractional CPUs
+- `--memory <MEMORY>` — Limit the memory available to the container, e.g. `2g` or `512m`
+
 ###### **Features:**
 
 - `--features <FEATURES>` — Build with the list of features activated, space or comma separated
@@ -408,13 +420,12 @@ To view the commands that will be executed, without executing them, use the --pr
 
 - `--print-commands-only` — Print commands to build without executing them
 
-###### **Verifiable:**
+###### **Verifiable Options:**
 
 - `--verifiable` — Build inside a trusted Docker container and record SEP-58 metadata (`bldimg`, `source_uri`, `source_sha256`, `bldopt`) so the resulting WASM can be reproduced and verified by third parties. Implies `--locked`. Requires a clean git working tree
 - `--image <IMAGE>` — Override the auto-selected container image used by `--verifiable`. Must be digest-pinned, e.g. `docker.io/stellar/stellar-cli@sha256:...`. Tag-only refs are rejected because SEP-58 requires content addressing
 - `--source-sha256 <SOURCE_SHA256>` — SEP-58 source identification: SHA-256 of the source archive (recorded as the `source_sha256` meta entry). Optional with `--verifiable`: the archive is always generated and its SHA-256 computed for you. When supplied it's treated as a pin — the build fails if it doesn't match the generated archive
-- `--source-uri <SOURCE_URI>` — SEP-58 source identification: URI where the source can be obtained, e.g. `https://example.com/src.tar.gz` (recorded as the `source_uri` meta entry). Optional with `--verifiable`; the recorded `source_sha256` is computed from the generated archive, unless `--source-sha256` is explicitly set
-- `-d`, `--docker-host <DOCKER_HOST>` — Override the default docker host used by `--verifiable`
+- `--source-uri <SOURCE_URI>` — entry). Optional with `--verifiable`; the recorded `source_sha256` is computed from the generated archive, unless `--source-sha256` is explicitly set
 
 ## `stellar contract extend`
 
@@ -1158,6 +1169,18 @@ Verify that a contract's WASM reproduces from the build metadata it records, per
 
 **Usage:** `stellar contract verify [OPTIONS]`
 
+###### **Container Options:**
+
+- `-d`, `--docker-host <DOCKER_HOST>` — Optional argument to override the default docker host. This is useful when you are using a non-standard docker host path for your Docker-compatible container runtime, e.g. Docker Desktop defaults to $HOME/.docker/run/docker.sock instead of /var/run/docker.sock
+- `--engine <ENGINE>` — Container engine to use [default: docker]
+
+  Possible values:
+  - `docker`: Docker, or any Docker-compatible CLI
+  - `apple-container`: Apple's `container` CLI (macOS 26+, Apple silicon)
+
+- `--cpus <CPUS>` — Limit the number of CPUs available to the container, e.g. `2`. A whole number: Apple's `container` engine does not accept fractional CPUs
+- `--memory <MEMORY>` — Limit the memory available to the container, e.g. `2g` or `512m`
+
 ###### **Global Options:**
 
 - `--config-dir <CONFIG_DIR>` — Location of config directory. By default, it uses `$XDG_CONFIG_HOME/stellar` if set, falling back to `~/.config/stellar` otherwise. Contains configuration files, aliases, and other persistent settings
@@ -1169,7 +1192,6 @@ Verify that a contract's WASM reproduces from the build metadata it records, per
 - `--wasm-hash <WASM_HASH>` — WASM hash (hex) to fetch the WASM from the network
 - `--source-uri <SOURCE_URI>` — Local source code file or http(s) URL to use as the source when the WASM's recorded SEP-58 metadata has only `source_sha256` (no `source_uri`). Accepts http(s) URLs or local file paths
 - `--trust` — Bypass interactive confirmation when the WASM's bldimg is not in the default trust list, or when the source is provided as an archive (source archives are never default-trusted)
-- `-d`, `--docker-host <DOCKER_HOST>` — Override the default docker host used by the rebuild
 - `--keep` — Keep the materialized source and rebuild output instead of deleting them on exit, and print the path. Useful for debugging a byte mismatch (e.g. diffing the rebuilt WASM's metadata against the original)
 
 ###### **RPC Options:**
@@ -1712,6 +1734,8 @@ Start local networks in containers
 - `logs` — Get logs from a running network container
 - `start` — Start a container running a Stellar node, RPC, API, and friendbot (faucet)
 - `stop` — Stop a network container started with `stellar container start`
+- `use` — Set the default container engine used by `stellar container` commands
+- `unset` — Unset the default container engine defined previously with `container use <engine>`
 
 ## `stellar container logs`
 
@@ -1728,6 +1752,11 @@ Get logs from a running network container
 ###### **Options:**
 
 - `-d`, `--docker-host <DOCKER_HOST>` — Optional argument to override the default docker host. This is useful when you are using a non-standard docker host path for your Docker-compatible container runtime, e.g. Docker Desktop defaults to $HOME/.docker/run/docker.sock instead of /var/run/docker.sock
+- `--engine <ENGINE>` — Container engine to use [default: docker]
+
+  Possible values:
+  - `docker`: Docker, or any Docker-compatible CLI
+  - `apple-container`: Apple's `container` CLI (macOS 26+, Apple silicon)
 
 ## `stellar container start`
 
@@ -1750,6 +1779,14 @@ By default, when starting a testnet container, without any optional arguments, i
 ###### **Options:**
 
 - `-d`, `--docker-host <DOCKER_HOST>` — Optional argument to override the default docker host. This is useful when you are using a non-standard docker host path for your Docker-compatible container runtime, e.g. Docker Desktop defaults to $HOME/.docker/run/docker.sock instead of /var/run/docker.sock
+- `--engine <ENGINE>` — Container engine to use [default: docker]
+
+  Possible values:
+  - `docker`: Docker, or any Docker-compatible CLI
+  - `apple-container`: Apple's `container` CLI (macOS 26+, Apple silicon)
+
+- `--cpus <CPUS>` — Limit the number of CPUs available to the container, e.g. `2`. A whole number: Apple's `container` engine does not accept fractional CPUs
+- `--memory <MEMORY>` — Limit the memory available to the container, e.g. `2g` or `512m`
 - `--name <NAME>` — Optional argument to specify the container name
 - `-l`, `--limits <LIMITS>` — Optional argument to specify the limits for the local network only
 - `-p`, `--ports-mapping <PORTS_MAPPING>` — Argument to specify the `HOST_PORT:CONTAINER_PORT` mapping
@@ -1774,6 +1811,39 @@ Stop a network container started with `stellar container start`
 ###### **Options:**
 
 - `-d`, `--docker-host <DOCKER_HOST>` — Optional argument to override the default docker host. This is useful when you are using a non-standard docker host path for your Docker-compatible container runtime, e.g. Docker Desktop defaults to $HOME/.docker/run/docker.sock instead of /var/run/docker.sock
+- `--engine <ENGINE>` — Container engine to use [default: docker]
+
+  Possible values:
+  - `docker`: Docker, or any Docker-compatible CLI
+  - `apple-container`: Apple's `container` CLI (macOS 26+, Apple silicon)
+
+## `stellar container use`
+
+Set the default container engine used by `stellar container` commands
+
+**Usage:** `stellar container use [OPTIONS] <ENGINE>`
+
+###### **Arguments:**
+
+- `<ENGINE>` — Container engine to use by default
+
+  Possible values:
+  - `docker`: Docker, or any Docker-compatible CLI
+  - `apple-container`: Apple's `container` CLI (macOS 26+, Apple silicon)
+
+###### **Global Options:**
+
+- `--config-dir <CONFIG_DIR>` — Location of config directory. By default, it uses `$XDG_CONFIG_HOME/stellar` if set, falling back to `~/.config/stellar` otherwise. Contains configuration files, aliases, and other persistent settings
+
+## `stellar container unset`
+
+Unset the default container engine defined previously with `container use <engine>`
+
+**Usage:** `stellar container unset [OPTIONS]`
+
+###### **Global Options:**
+
+- `--config-dir <CONFIG_DIR>` — Location of config directory. By default, it uses `$XDG_CONFIG_HOME/stellar` if set, falling back to `~/.config/stellar` otherwise. Contains configuration files, aliases, and other persistent settings
 
 ## `stellar config`
 

cmd/soroban-cli/src/commands/contract/verify.rs

@@ -11,12 +11,12 @@ use walkdir::WalkDir;
 
 use crate::{
     commands::{
-        container,
+        container::shared::{self, Args as ContainerArgs, RunArgs as ContainerRunArgs},
         contract::build::{
             source_archive,
             verifiable::{self, bldimg_regex, source_sha256_regex, source_uri_regex},
         },
-        global,
+        global, HEADING_CONTAINER,
     },
     config::{self, locator, network},
     print::Print,
@@ -54,10 +54,6 @@ pub struct Cmd {
     #[arg(long)]
     pub trust: bool,
 
-    /// Override the default docker host used by the rebuild.
-    #[arg(short = 'd', long, env = "DOCKER_HOST")]
-    pub docker_host: Option<String>,
-
     /// Keep the materialized source and rebuild output instead of deleting them
     /// on exit, and print the path. Useful for debugging a byte mismatch (e.g.
     /// diffing the rebuilt WASM's metadata against the original).
@@ -69,6 +65,12 @@ pub struct Cmd {
 
     #[command(flatten)]
     pub network: network::Args,
+
+    #[command(flatten, next_help_heading = HEADING_CONTAINER)]
+    pub container_args: ContainerArgs,
+
+    #[command(flatten, next_help_heading = HEADING_CONTAINER)]
+    pub run_args: ContainerRunArgs,
 }
 
 #[derive(thiserror::Error, Debug)]
@@ -158,7 +160,7 @@ pub enum Error {
     Verifiable(#[from] verifiable::Error),
 
     #[error(transparent)]
-    DockerConnection(#[from] container::shared::Error),
+    DockerConnection(#[from] shared::Error),
 
     #[error("could not find a rebuilt WASM under {target}")]
     NoRebuiltWasm { target: PathBuf },
@@ -362,11 +364,12 @@ impl Cmd {
         global_args: &global::Args,
         print: &Print,
     ) -> Result<(), Error> {
-        // Rebuild in the recorded bldimg. Every docker interaction shells out to
-        // the `docker` CLI through this `Args` (honoring `--docker-host`).
-        let docker = container::shared::Args {
-            docker_host: self.docker_host.clone(),
-        };
+        // Rebuild in the recorded bldimg. Every interaction shells out through
+        // these `container_args`, which select the engine binary (`--engine`/
+        // `STELLAR_CONTAINER_ENGINE`, default docker) and honor `--docker-host`
+        // where the engine supports it.
+        let docker = self.container_args.clone();
+        docker.warn_if_host_ignored(print);
         docker.pull_image(&meta.bldimg, print).await?;
 
         // `--locked` was only added to `contract build` in cli 25.2.0. The
@@ -400,6 +403,7 @@ impl Cmd {
             &[container_cmd],
             &env,
             &docker,
+            &self.run_args,
             print,
             global_args.verbose || global_args.very_verbose,
         )