[BUG] docker-desktop cask hits sudo on multiple /usr/local paths; switch default to colima

[Defilan]

Bug Description

Even after PR #7 pre-created /usr/local/cli-plugins, the
docker-desktop cask still fails the next /usr/local/* path it
wants to create. Latest failure (Mac Studio, 2026-05-23):

Error: Failure while executing; `/usr/bin/sudo -E -- mkdir -p -- /usr/local/bin` exited with 1.
sudo: a terminal is required to read the password

docker-desktop writes to multiple /usr/local/* paths the cask
postinstall hook tries to sudo mkdir:

• /usr/local/cli-plugins (PR fix(homebrew): pre-create /usr/local/cli-plugins for docker cask; modernize fact refs #7 fixed)
• /usr/local/bin (this failure)
• likely more (/usr/local/share, /usr/local/etc, ...)

Patching each path one at a time is whack-a-mole.

Root Cause

The architectural choice itself is the problem: docker-desktop's
installer was designed for Intel Macs where /usr/local/* is the
user-writable Homebrew prefix. On Apple Silicon, Homebrew lives at
/opt/homebrew and /usr/local/* is root-owned with most
subdirectories absent on a fresh install. Docker Desktop's cask
postinstall keeps the legacy convention and requires sudo to
populate /usr/local/* directories — but Ansible runs brew under
become: false, brew's internal sudo bypasses Ansible's BECOME
plumbing, and there is no TTY for the password prompt.

Proposed Fix

Switch the default Docker runtime from docker-desktop to
colima. Three reasons:

1. No sudo writes. colima runs entirely in user space (Lima
   VM backend under ~/.colima/). No /usr/local/* mkdir. The
   whole class of cask-postinstall-sudo bugs goes away.
2. Matches the existing Mac Mini setup. The Mac Mini's
   OpenClaw stack already uses Docker via colima
   (~/.colima/default/docker.sock). Bootstrap default aligns
   the convention across hosts.
3. Lighter weight. Lima-backed VM uses meaningfully less
   resident memory than Docker Desktop. Helpful on a 36 GB Mac
   Studio that also runs a 32B model.

Concrete changes

• roles/homebrew/defaults/main.yml:

  • homebrew_casks defaults to [] (was [docker])
  • Add colima, docker, docker-compose, docker-buildx to
    homebrew_cli_packages

• roles/kubernetes/defaults/main.yml:

  • colima_cpu: 4
  • colima_memory_gib: 6
  • colima_disk_gib: 60

• roles/kubernetes/tasks/main.yml:

  • Replace open -ga Docker + docker info retry loop with
    colima start --cpu N --memory N --disk N (idempotent: skips
    when already running)

• README.md: update install steps to mention colima.

Backward compat

PR #7's pre-create-cli-plugins task stays in place. Users who
explicitly set homebrew_casks: [docker] in their group_vars
still opt into Docker Desktop and the pre-task handles the
cli-plugins case. They will, however, need to manually sudo mkdir -p /usr/local/bin && chown if they hit additional /usr
/local paths — documented in README as a "Docker Desktop quirk
on Apple Silicon" callout.

Severity

High. Same severity as #5: ./bootstrap.sh cannot complete a
default install on a fresh Apple Silicon Mac without manual sudo
intervention.

Surfaced bootstrapping the Mac Studio on 2026-05-23, immediately
after PR #7 was merged and pulled.