FROM ghcr.io/astral-sh/uv:debian-slim

ADD . /app
WORKDIR /app

RUN useradd -m -r musik && \
    chown -R musik /app

USER musik

ENV PYTHONDONTWRITEBYTECODE=1
ENV PYTHONUNBUFFERED=1
ENV YOUTUBE_OAUTH_SECRETS="/config/secret.json"

RUN uv sync --locked

CMD ["/app/entrypoint.sh"]