FROM python:3.12-slim AS builder

RUN apt-get update && apt-get install -y --no-install-recommends curl \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /build
COPY pyproject.toml uv.lock ./
SHELL ["/bin/bash", "-o", "pipefail", "-c"]
RUN curl -LsSf https://astral.sh/uv/0.5.25/install.sh | sh \
    && . "$HOME/.local/bin/env" \
    && uv sync --frozen

SHELL ["/bin/sh", "-c"]

FROM builder AS runtime

RUN groupadd -r appuser \
    && useradd -r -g appuser -d /app -s /bin/bash appuser

WORKDIR /app
COPY src/ ./src/

RUN chown -R appuser:appuser /app /build

USER appuser