FROM python:3.12-slim AS builder

WORKDIR /build

COPY pyproject.toml uv.lock ./
RUN pip install --no-cache-dir uv==0.5.25 && uv sync --frozen

FROM python:3.12-slim

RUN apt-get update && apt-get install -y --no-install-recommends curl \
    && rm -rf /var/lib/apt/lists/*

RUN groupadd -r appuser && useradd -r -g appuser -d /app -m appuser

WORKDIR /app

COPY --from=builder /build/.venv /app/.venv
COPY src/ ./src/

ENV PATH="/app/.venv/bin:$PATH"

RUN mkdir -p /app/data && chown -R appuser:appuser /app

USER appuser