FROM ghcr.io/astral-sh/uv:python3.14-bookworm-slim

RUN uvx --from corio apt-headless ca-certificates # emSign mitigation.

RUN useradd --uid 1000 --create-home --shell /bin/bash user

ENV HOME=/home/user \
    PATH="/home/user/.local/bin:${PATH}" \
    UV_CACHE_DIR=/home/user/.cache/uv

ARG WHEEL
ARG PACKAGE
ARG ENTRYPOINT

USER user

RUN --mount=type=bind,source=${WHEEL},target=/tmp/${WHEEL},ro \
    uv run --no-project --with "${PACKAGE} @ file:///tmp/${WHEEL}" true

COPY --chown=user:user ${WHEEL} /opt/${WHEEL}

ENV PACKAGE_SPEC="${PACKAGE} @ file:///opt/${WHEEL}" \
    ENTRYPOINT_NAME="${ENTRYPOINT}"

ENTRYPOINT ["sh", "-c", "exec uv run --no-project --offline --with \"$PACKAGE_SPEC\" \"$ENTRYPOINT_NAME\" \"$@\"", "--"]
