feat(homebrew,kubernetes): switch default Docker runtime from docker-desktop to colima

[Defilan]

What

Switch the default Docker runtime in llmkube-bootstrap from
Docker Desktop to colima. Resolves the class of bug where
the docker-desktop cask postinstall hook tries to sudo mkdir
multiple /usr/local/* directories that do not exist on a fresh
Apple Silicon Mac.

Why

Fixes #8.

PR #7 patched /usr/local/cli-plugins. The next ./bootstrap.sh
run on a fresh Mac Studio (2026-05-23) hit the same class of bug
on /usr/local/bin:

Error: Failure while executing; `/usr/bin/sudo -E -- mkdir -p -- /usr/local/bin` exited with 1.
sudo: a terminal is required to read the password

docker-desktop wants to write to many /usr/local/* paths. Patching
each one with a pre-task is whack-a-mole. The class of bug exists
because docker-desktop was designed for Intel Macs (where
/usr/local/* is the user-writable Homebrew prefix); on Apple
Silicon /usr/local/ is root-owned and Homebrew lives at
/opt/homebrew/, so every sudo mkdir in the cask postinstall is
a foot-gun.

colima eliminates the entire class:

• Pure user-space (Lima VM at ~/.colima/, no /usr/local/* writes)
• Provides a Docker socket kind consumes transparently
• Matches the convention already in use on other LLMKube hosts (Mac
  Mini's OpenClaw stack runs Docker via colima)
• Smaller resident memory footprint than Docker Desktop — useful on
  Macs that also serve a 30B-class model via mlx-server

How

roles/homebrew/defaults/main.yml

• homebrew_casks defaults to [] (was [docker])
• New CLI packages: colima, docker, docker-compose, docker-buildx

The CLI tools talk to colima's Docker socket. No Desktop app is
installed, no /usr/local/* paths are touched.

roles/kubernetes/defaults/main.yml (new)

VM sizing knobs, tunable via group_vars or --extra-vars:

colima_cpu: 4
colima_memory_gib: 6
colima_disk_gib: 60

Tuned for a single-node kind cluster plus a couple of small
workloads — enough headroom that kind create cluster doesn't OOM,
not so much that we steal RAM from mlx-server.

roles/kubernetes/tasks/main.yml

Replace the Docker Desktop start sequence (open -ga Docker +
docker info retry loop) with a colima status check + a conditional
colima start --cpu N --memory N --disk N. Idempotent: skips when
colima is already running.

The docker info retry stays — it now confirms colima's Docker
socket is reachable rather than Docker Desktop's.

README.md

• "What it sets up" section now describes colima as the default
  Docker provider
• New section: Docker Desktop on Apple Silicon (opt-in only)
  documents the override path for users who specifically want Docker
  Desktop, including the two /usr/local/* caveats and the
  sudo mkdir -p /usr/local/bin && chown workaround for the
  /usr/local/bin case

Backward compat

PR #7's Pre-create /usr/local/cli-plugins pre-task stays in place.
Its when: clause already no-ops when homebrew_casks lacks
docker / docker-desktop. Users who explicitly opt into Docker
Desktop in their group_vars still get the cli-plugins workaround
for free; only the /usr/local/bin path needs a manual sudo touch.

Verification

Local:

• ansible-playbook --syntax-check: clean
• Diff: 4 files (1 new), +110 / -16
• Manual sanity-check that colima_cpu / colima_memory_gib /
  colima_disk_gib flow into the colima start invocation

CI:

• yamllint, ansible-lint, shellcheck, macos-check,
  macos-homebrew all run on every PR
• macos-homebrew is the high-leverage check: it runs
  ansible-playbook ... --tags 'always,system,homebrew' against a
  fresh GitHub-hosted Apple Silicon runner. With this PR's defaults
  it should install colima + the CLI tools + zero casks and exit
  cleanly. Any breakage in the cask removal / CLI additions surfaces
  there.

Live (post-merge):

• Re-run ./bootstrap.sh on the Mac Studio. Expected: colima
  installs, starts, kind cluster comes up, LLMKube operator
  deploys, no sudo prompts beyond the BECOME pass (from PR fix(homebrew): pre-create /usr/local/cli-plugins for docker cask; modernize fact refs #7's
  pre-task, which is now inert because docker-desktop is no longer
  in defaults).

Related

• [BUG] ./bootstrap.sh fails with empty 'unrecognized arguments:' when no extra ansible-playbook args supplied #2 / PR fix(bootstrap): EXTRA_ARGS expansion produced phantom empty positional arg #3 — EXTRA_ARGS phantom-arg fix (merged)
• [FEATURE] CI: smoke-test ./bootstrap.sh end-to-end (closes the gap that let #2 ship) #4 — CI gap: bootstrap.sh entrypoint not smoke-tested
• [BUG] homebrew cask install of docker-desktop fails: sudo without TTY when creating /usr/local/cli-plugins #5 + [BUG] group_vars/all.yml references deprecated top-level fact var (ansible-core 2.24 removes it) #6 / PR fix(homebrew): pre-create /usr/local/cli-plugins for docker cask; modernize fact refs #7 — cli-plugins pre-task + facts-deprecation sweep (merged)
• [BUG] docker-desktop cask hits sudo on multiple /usr/local paths; switch default to colima #8 — this PR

Checklist

• ansible-playbook --syntax-check passes locally
• No docker_desktop / open -ga Docker references remain
• README documents both default (colima) + opt-in (docker-desktop)
• Conventional commit + DCO sign-off
• References issue this closes