fix: use bullseye base for Docker build, drop glibc floor from 2.34 to 2.29

Author: NathanFlurry

docs-internal/arch/glibc-portability.md

@@ -3,35 +3,38 @@
 ## Summary
 
 The `secure-exec-v8` binary (Rust + V8 engine) is dynamically linked against glibc.
-The minimum glibc version on target systems is determined by two factors:
+The minimum glibc version on target systems is determined by the build environment's glibc version, because the linker stamps versioned symbol requirements into the binary at link time.
 
-1. **rusty_v8 prebuilt static libraries** require **glibc >= 2.32** (due to `sem_clockwait` in V8's `sem_waiter.o`)
-2. **Rust standard library** links against pthread symbols that were re-versioned in **glibc 2.34** when `libpthread.so` was merged into `libc.so.6`
+The two key factors:
 
-If we build on a system with glibc >= 2.34, the resulting binary requires glibc >= 2.34 at runtime because all pthread symbols (`pthread_create`, `sem_wait`, `dlsym`, etc.) get stamped with `GLIBC_2.34` version tags.
-
-If we build on a system with glibc 2.32–2.33, pthread symbols resolve against the older separate `libpthread.so` version tags, and the effective floor drops to 2.32 (set by V8).
+1. **Rust standard library** links against pthread symbols. In glibc 2.34, `libpthread.so` was merged into `libc.so.6`, so all pthread symbols got re-versioned to `GLIBC_2.34`. Building on glibc < 2.34 avoids this jump.
+2. **rusty_v8 prebuilt static libraries** reference `sem_clockwait` (`GLIBC_2.30`) and other symbols. On Bullseye (glibc 2.31), `sem_clockwait` is available in the separate `libpthread.so`.
 
 ## Build base image policy
 
-All Linux build environments (Dockerfiles, CI runners) must use **Ubuntu 22.04 (Jammy)** as the base, which ships glibc 2.35. This:
+All Linux build environments (Dockerfiles, CI runners) must use **Debian Bullseye (glibc 2.31)**.
+
+This produces binaries requiring only **glibc >= 2.29**, verified empirically:
 
-- Satisfies V8's hard floor of glibc 2.32
-- Produces binaries compatible with glibc 2.35+ systems
-- Covers Ubuntu 22.04+, Debian 12+, Amazon Linux 2023, Fedora 36+, RHEL 9+
+```
+BOOKWORM build: glibc floor = 2.34
+BULLSEYE build: glibc floor = 2.29
+```
 
 Specifically:
-- Dockerfiles: `FROM rust:1.85.0-jammy` (not bookworm, not bullseye)
-- GitHub Actions: `ubuntu-22.04` (not `ubuntu-latest`, which floats)
+- Dockerfiles: `FROM rust:1.85.0-bullseye`
+- GitHub Actions: `ubuntu-22.04` (the oldest available runner; glibc 2.35, but still better than `ubuntu-latest` which floats to newer versions)
+
+Note: GitHub Actions doesn't offer a Bullseye runner, so CI builds will have a higher glibc floor (~2.29 from Bullseye Docker, ~2.34 from ubuntu-22.04 runner). For maximum portability, prefer Docker-based builds.
 
 ## Why not older?
 
-- **Bullseye (glibc 2.31)**: V8's `sem_clockwait` symbol requires 2.32. Linking would fail.
-- **CentOS 7 (glibc 2.17)**: Same problem, plus ancient toolchain.
+- **CentOS 7 (glibc 2.17)**: `sem_clockwait` and other symbols V8 needs don't exist.
+- **Buster (glibc 2.28)**: `sem_clockwait` (GLIBC_2.30) is missing from libpthread.
 
 ## Why not musl?
 
-The rusty_v8 crate only ships prebuilt `.a` files for `*-linux-gnu` targets. Building V8 from source against musl would require patching V8's build system and takes 30–60 minutes per platform. Not worth it given the glibc 2.35 floor is adequate.
+The rusty_v8 crate only ships prebuilt `.a` files for `*-linux-gnu` targets. Building V8 from source against musl would require patching V8's build system and takes 30–60 minutes per platform. Not worth it given the glibc 2.29 floor covers virtually all active Linux distributions.
 
 ## How to verify
 
@@ -47,12 +50,14 @@ The highest version in the output is the minimum glibc required at runtime.
 
 | Distro | glibc | Compatible? |
 |---|---|---|
-| Ubuntu 20.04 | 2.31 | No |
-| Debian 11 (Bullseye) | 2.31 | No |
+| CentOS 7 | 2.17 | No |
 | Amazon Linux 2 | 2.26 | No |
+| Debian 10 (Buster) | 2.28 | No |
+| Ubuntu 20.04 | 2.31 | Yes |
+| Debian 11 (Bullseye) | 2.31 | Yes |
+| Amazon Linux 2023 | 2.34 | Yes |
 | Ubuntu 22.04 | 2.35 | Yes |
 | Debian 12 (Bookworm) | 2.36 | Yes |
-| Amazon Linux 2023 | 2.34 | Yes |
 | Ubuntu 24.04 | 2.39 | Yes |
 | Fedora 36+ | 2.35+ | Yes |
 | RHEL 9 | 2.34 | Yes |

native/v8-runtime/docker/Dockerfile.linux-x64-gnu

@@ -1,8 +1,8 @@
-# Build base pinned to Ubuntu 22.04 (glibc 2.35) for portability.
+# Build base pinned to Debian Bullseye (glibc 2.31) for portability.
 # See docs-internal/arch/glibc-portability.md
-FROM rust:1.85.0-jammy AS builder
+FROM rust:1.85.0-bullseye AS builder
 WORKDIR /build
-COPY Cargo.toml Cargo.lock rust-toolchain.toml ./
+COPY Cargo.toml Cargo.lock rust-toolchain.toml build.rs ./
 RUN mkdir src && echo 'fn main() {}' > src/main.rs
 RUN --mount=type=cache,target=/usr/local/cargo/registry \
     --mount=type=cache,target=/usr/local/cargo/git \