Publish Docker image variant with V8 pointer compression (-pc tags)

[kriszyp]

Summary

Adds a pointer-compression variant of the Docker image — harperfast/harper-pro:<version>-pc — whose runtime Node is compiled with --experimental-enable-pointer-compression: ~40% lower JS heap memory (43% measured on a 2M-object graph: 376→215 MB heapUsed; idle container RSS 2.07→1.7 GiB) with a 4 GB heap cap per isolate (per worker thread — Node uses per-isolate cages, and Harper's automatic worker heap sizing never exceeds 4 GB). For heap-bound edge deployments this is roughly a 40% density win. Closes HarperFast/harper#919.

Pieces:

• build-tools/node-pointer-compression.Dockerfile + publish-node-pc-image.yaml (dispatch-only): builds harperfast/node-pointer-compression:<major> — the standard node image with the node binary rebuilt from source, plus uWebSockets.js and @datadog/pprof binaries rebuilt against the pointer-compression V8 ABI. Dispatch-only so the 1–2 h Node compile never slows a release; re-run when the Node version / uWS pin / pprof version bumps.
• Dockerfile: new RUN_IMAGE build arg; on a pointer-compression base, swaps in the rebuilt uWS + pprof binaries (with .pointer-compression-build markers), drops version-specific direct-V8 addon variants (node.abi*.node) in favor of their Node-API builds, and fails the build if any raw-V8-ABI binary that could load on the runtime remains (build-tools/check-native-abi-pointer-compression.js).
• publish-docker.yaml: explicit build matrix with pc legs (default Node version only) and a merge-pc job pushing -pc tags, with a release-time assertion that pointer compression is on and the rebuilt uWS constructs in the pushed image.
• analytics/profile.ts: on a pointer-compression runtime without the pprof marker, profiling is skipped with a warning instead of crashing.

Why the uWS/pprof rebuilds are necessary

Both link the raw V8 C++ ABI (not Node-API); their upstream prebuilds load cleanly on a pointer-compression node and then segfault on first use — both verified live (pprof crashed PID 1 at boot +1s; uWS.App() SIGSEGVs). The pointer-compression ABI is set by header-level defines, so rebuilding with matching defines fixes them: uWS follows its own build.c recipe with the PC defines added; pprof is built from the DataDog/pprof-nodejs repo (its npm package ships no C++ sources) simply by running node-gyp under the pointer-compression node — node-gyp derives its defines from the running node's process.config, which is also why in-image source-built addons (segfault-handler) are automatically correct. All other production native modules (rocksdb-js, lmdb, msgpackr/cbor-extract, argon2, bufferutil, utf-8-validate) are Node-API and unaffected.

Validated end-to-end (local amd64 builds)

Booted the pc image with HARPER_UWS_HTTP=true and a 15 s profiling capture period: uWS serves (uWebSockets: 20 response header), profiler captures repeatedly, insert/read green, no segfaults; negative test (marker removed) degrades to a per-worker warning with the instance healthy.

Attention / open items

• Rollout ordering: after merge, dispatch Publish Node Pointer-Compression Base Image once before the next release; until then the pc build legs would fail (standard legs unaffected, but the Slack success message gates on both merge jobs).
• Version pins to keep in sync manually (documented in-file): PPROF_VERSION (package-lock) and UWS_SOURCE_COMMIT (the source_commit file inside the pinned uWS binaries tarball).
• The pc variant intentionally trades the direct-V8 fast paths of cbor-extract (node.abi*.node) for its Node-API build.
• Base image is currently node:24 (bookworm); once fix: base Docker image on Debian trixie for uWebSockets.js glibc 2.38 #564 (trixie) lands it should follow — the pc variant is glibc-self-consistent either way since its V8-ABI addons are compiled in-image.
• Companion PR Refuse uWS backend on pointer-compression Node builds unless rebuilt for that ABI harper#1765 adds the core-side uWS guard honoring the marker (not required for this image to work — the rebuilt addon simply works — it protects standalone/npm installs on pointer-compression nodes).
• Pre-existing, unrelated: tsc reports Numeric-vs-number errors in analytics/profile.ts sample processing (pprof-format types); the package build does not gate on them.

🤖 Generated with Claude Code (Fable 5)

[gemini-code-assist]

Code Review

This pull request introduces support for a Node.js runtime variant compiled with V8 pointer compression. It adds a dedicated Dockerfile to build the custom Node.js image, rebuilds incompatible native modules (uWebSockets.js and @datadog/pprof) against the pointer-compression ABI, and implements an ABI guard script to verify native module compatibility during the build. Additionally, the profiling logic is updated to safely disable profiling if pointer compression is active but the compatible @datadog/pprof binary is missing. Feedback on the changes highlights two key issues: first, the ABI guard script could silently bypass checks if the nm utility is missing from the system; second, using __filename in analytics/profile.ts will throw a ReferenceError in ES module environments, causing profiling to be silently disabled. Both comments provide actionable code suggestions to resolve these issues.

[claude]

Reviewed; no blockers found.