feat: enable pointer compression to reduce memory usage by ~50%

[ChiragAgg5k]

Summary

This PR enables V8 pointer compression in the AI Assistant by switching to the platformatic/node-caged Docker image.

What Changed

• Base Image: Changed from node:18-alpine to platformatic/node-caged:25-slim
• Package Manager: Updated from apk (Alpine) to apt-get (Debian)
• Corepack: Added explicit npm install -g corepack for Node 25 compatibility
• Node Version: Upgraded from Node 18 to Node 25

Benefits

• ~50% reduction in V8 heap memory for object-heavy workloads
• Lower infrastructure costs on Kubernetes
• Better garbage collection performance
• Minimal CPU overhead (2-4% latency increase)

References

• https://blog.platformatic.dev/we-cut-nodejs-memory-in-half
• https://hub.docker.com/r/platformatic/node-caged

Summary by CodeRabbit

• Chores
  • Updated Docker base image to a newer, slimmer runtime.
  • Modernized container build tooling and package management for a more standard Debian-based build.
  • Added a non-root runtime user and ownership adjustments for safer container execution.
  • Included a placeholder environment variable for runtime configuration.

[coderabbitai]

Walkthrough

The Dockerfile now uses base image platformatic/node-caged:25-slim instead of node:18-alpine. apk package ops are replaced with apt-get, swapping build-base for build-essential while keeping python3, make, g++, and git; apt lists are cleaned after install. npm install -g corepack is added before running corepack enable and corepack prepare pnpm@10.0.0 --activate. The final stage adds a non-root user (useradd -r -u 1001 appuser), chowns /usr/src/app, sets ENV _APP_ASSISTANT_OPENAI_API_KEY='', switches to USER appuser, and retains EXPOSE 3003 and CMD ["node","src/main.js"].

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Title check	⚠️ Warning	The PR title claims to enable pointer compression for 50% memory reduction, but the changeset only updates the Dockerfile base image and package manager without explicitly enabling pointer compression or any memory optimization flags.	Update the title to accurately reflect the actual change: 'feat: upgrade Node.js to 25 with platformatic/node-caged base image' or similar, as pointer compression is a feature of the new base image, not an explicit change made in this PR.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch feat/pointer-compression

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

Dockerfile (1)

3-9: Add --no-install-recommends and remove redundant packages.

1. Missing flag: Add --no-install-recommends to avoid pulling in unnecessary recommended packages, reducing image size.

2. Redundancy: build-essential already includes g++ and make, so listing them separately is redundant.

♻️ Proposed fix

-RUN apt-get update && apt-get install -y \+RUN apt-get update && apt-get install -y --no-install-recommends \
python3 \
- make \- g++ \
build-essential \
git \
&& rm -rf /var/lib/apt/lists/*

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.
In `@Dockerfile` around lines 3 - 9, Update the Dockerfile's apt install RUN
command to add the --no-install-recommends flag and remove redundant packages
g++ and make (since build-essential already provides them): change the RUN line
that starts with "apt-get update && apt-get install -y" to include
"--no-install-recommends" and only install python3, build-essential, git (plus
any other truly required packages), keeping the trailing "&& rm -rf
/var/lib/apt/lists/*" cleanup intact.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@Dockerfile`:
- Line 1: The Dockerfile currently uses the platformatic/node-caged:25-slim base
image and leaves the container running as root; add a non-root runtime user for
production security by creating a system user (e.g., UID 1001) and switching to
it before the container start instructions (place the RUN useradd -r -u 1001
appuser and USER appuser lines before EXPOSE/CMD), ensuring subsequent steps
that require root remain earlier in the Dockerfile and that the final stage runs
as appuser.
---
Nitpick comments:
In `@Dockerfile`:
- Around line 3-9: Update the Dockerfile's apt install RUN command to add the
--no-install-recommends flag and remove redundant packages g++ and make (since
build-essential already provides them): change the RUN line that starts with
"apt-get update && apt-get install -y" to include "--no-install-recommends" and
only install python3, build-essential, git (plus any other truly required
packages), keeping the trailing "&& rm -rf /var/lib/apt/lists/*" cleanup intact.

---

ℹ️ Review info

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between bffb784 and 2a455d5.

📒 Files selected for processing (1)

• Dockerfile

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (2)

Dockerfile (2)

3-9: Add --no-install-recommends and remove redundant packages.

Two improvements for this apt-get install:

1. Add --no-install-recommends to minimize image size by excluding suggested packages
2. build-essential already includes make and g++, so listing them separately is redundant

♻️ Proposed fix

-RUN apt-get update && apt-get install -y \+RUN apt-get update && apt-get install -y --no-install-recommends \
python3 \
- make \- g++ \
build-essential \
git \
&& rm -rf /var/lib/apt/lists/*

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.
In `@Dockerfile` around lines 3 - 9, Update the Dockerfile RUN apt-get install
invocation to add --no-install-recommends to minimize image size and remove
redundant explicit packages already provided by build-essential (remove make and
g++ from the package list); keep python3, git and build-essential and retain the
apt-get update && rm -rf /var/lib/apt/lists/* sequence so the command remains
efficient and small.

---

50-55: Non-root user setup looks good; consider runtime secret injection.

The non-root user implementation correctly addresses security concerns. However, the ENV _APP_ASSISTANT_OPENAI_API_KEY='' declaration (flagged by static analysis) creates an empty environment variable in the image. While this is likely overridden at runtime, consider:

1. Removing the ENV declaration entirely and relying on runtime injection via -e or Kubernetes secrets
2. Or adding a comment clarifying this is intentionally empty for validation/documentation

This avoids static analysis noise and makes the secret-injection expectation explicit.

♻️ Option: Remove ENV and document runtime requirement

 RUN useradd -r -u 1001 appuser && \
chown -R appuser:appuser /usr/src/app
-ENV _APP_ASSISTANT_OPENAI_API_KEY=''+# _APP_ASSISTANT_OPENAI_API_KEY must be provided at runtime via environment
USER appuser

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.
In `@Dockerfile` around lines 50 - 55, Remove the empty ENV declaration for
_APP_ASSISTANT_OPENAI_API_KEY from the Dockerfile to avoid baking a blank secret
into the image; instead document the runtime-secret expectation by either (a)
deleting the line ENV _APP_ASSISTANT_OPENAI_API_KEY='' and relying on runtime
injection (docker -e / Kubernetes Secret) or (b) if you prefer to keep a
placeholder, replace the ENV with a commented note above the USER appuser / RUN
useradd lines explaining that the API key must be provided at runtime via
environment injection and not baked into the image. Ensure references to the
variable name _APP_ASSISTANT_OPENAI_API_KEY and the non-root setup (RUN useradd
-r -u 1001 appuser and USER appuser) are preserved.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@Dockerfile`:
- Line 1: Replace the Node.js 25 base image with the Node.js 24 LTS image by
updating the Dockerfile's FROM instruction (the existing "FROM
platformatic/node-caged:25-slim" line) to use "platformatic/node-caged:24-slim"
so the build uses the LTS-supported Node 24 runtime for production stability and
longer security support.
---
Nitpick comments:
In `@Dockerfile`:
- Around line 3-9: Update the Dockerfile RUN apt-get install invocation to add
--no-install-recommends to minimize image size and remove redundant explicit
packages already provided by build-essential (remove make and g++ from the
package list); keep python3, git and build-essential and retain the apt-get
update && rm -rf /var/lib/apt/lists/* sequence so the command remains efficient
and small.
- Around line 50-55: Remove the empty ENV declaration for
_APP_ASSISTANT_OPENAI_API_KEY from the Dockerfile to avoid baking a blank secret
into the image; instead document the runtime-secret expectation by either (a)
deleting the line ENV _APP_ASSISTANT_OPENAI_API_KEY='' and relying on runtime
injection (docker -e / Kubernetes Secret) or (b) if you prefer to keep a
placeholder, replace the ENV with a commented note above the USER appuser / RUN
useradd lines explaining that the API key must be provided at runtime via
environment injection and not baked into the image. Ensure references to the
variable name _APP_ASSISTANT_OPENAI_API_KEY and the non-root setup (RUN useradd
-r -u 1001 appuser and USER appuser) are preserved.

---

ℹ️ Review info

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 2a455d5 and cc38221.

📒 Files selected for processing (1)

• Dockerfile