zuv
Pack your uv project into one .py file. Hand it over, drop it on a server, email it - uv run app.zuv.py and it works.
Why
- One file, no setup. No zip + README +
requirements.txt+ venv dance. Recipient runs one command. - Cross-platform, cross-Python. Same file works on Windows / Linux / macOS and any Python minor version (bytecode is built on the target).
- Tiny. ~10 KB even for a FastAPI app - deps install at first run, they're not embedded (unless you ask with
--deps). - Just uv. No bespoke runtime, no PyInstaller-style freezing. The bundle is a PEP 723 script;
uv runis the entrypoint.
Install
uv tool install zuv
Quick start
zuv build # -> ./dist/<name>.zuv.py
uv run dist/<name>.zuv.py # run it
dist/ is wiped on every build. Bundles ship .py sources (no bytecode), so the same file works on any OS and any Python minor version. First run extracts into dist/.zuv/<name>_<hash>/, installs deps into a local .venv, runs your entry. Later runs skip extraction.
Commands
zuv build [project] [flags]
| arg / flag | what it does |
|---|---|
project |
Path to the uv project (containing pyproject.toml). Default: current directory. |
-o, --output |
Output file path. Default: ./dist/<project-name>.zuv.py (or .zuv.zip with --zip). |
-e, --entry |
Entry script relative to project root. Default: [tool.zuv].entry, then src/main.py, then main.py. |
--zip |
Wrap the .zuv.py in a .zuv.zip with run.bat (Windows) + run.sh (Unix/macOS) launchers. The launchers install uv from https://astral.sh/uv if missing, then run the bundle. For recipients with neither uv nor Python. |
--deps [LIST] |
Embed wheels for the locked deps so the bundle runs offline. Bare = current OS only. all = every supported platform. Comma list = pick from windows, linux, linux-arm, macos, macos-arm. Wheels are tied to the Python minor you build with. Note: wheels can't carry OS libs (libGL, libpq, …); on bare Linux, apt install what ImportError names. Prefer -headless variants. |
--no-compile |
Tell the loader to skip the first-run .py → .pyc compile. Cache stays as plain .py; per-import startup is slower. |
--update-repo REPO |
Make the bundle self-update from a GitHub or GitLab repo's Releases. Accepts a URL (https://github.com/user/repo, https://gitlab.com/user/repo) or shorthand (user/repo → GitHub, gitlab:user/repo → GitLab). On every startup it asks the Releases API for the named asset and the release's tag_name. If the bundled [project] version from pyproject and the remote tag both parse as dotted-int versions, the loader skips when local ≥ remote (no prompt for older or equal). Otherwise (e.g. rolling latest tag) it falls back to comparing the asset's id; prompts install latest version? [Y/n] when something changed. Declined versions are remembered. Non-TTY runs skip silently. Private repos: set $GH_TOKEN (GitHub) or $GITLAB_TOKEN (GitLab). ZUV_NO_UPDATE=1 disables. |
--update-tag TAG |
Release tag to fetch the asset from. Default: latest (special value: hits the provider's /releases/latest endpoint). Use a fixed tag to pin recipients to one release. |
--update-file FILENAME |
Asset filename inside the release. Default: <output-stem>.zuv.py. Lets one release host several bundles (e.g. fastapi.zuv.py, dashboard.zuv.py). |
zuv run <file> [-- script-args...]
Thin wrapper around uv run <file>. Identical to running the bundle directly with uv.
zuv inspect <file>
Print the entry, build hash, sha256, PEP 723 metadata, and a summary of the embedded loader bytecode. Payload is elided.
zuv clean [target]
Remove every .zuv/ extraction cache under target (default: cwd). target can be a directory or a built .zuv.py (its parent is used). Persistent volumes (see below) are kept by default; pass --data to also wipe them.
zuv volume <locate|wipe|backup> <file>
Developer helpers for a bundle's persistent volume (see Persistent storage).
locate <file>- print the on-disk host path of the volume.wipe <file> [-y]- delete the volume (prompts unless-y).backup <file> [-o OUT]- write atar.gzof the volume contents.
Runtime env vars
| var | default | purpose |
|---|---|---|
ZUV_CACHE_DIR |
next to script | Override where the bundle extracts. |
ZUV_MAX_EXTRACT_BYTES |
2 GiB | Decompression-bomb cap. |
ZUV_NO_UPDATE |
(unset) | If set, disables the --update-repo self-update check at startup. |
GH_TOKEN / GITHUB_TOKEN |
(unset) | Sent as Authorization: Bearer … on GitHub update checks. Required for private GitHub repos. |
GITLAB_TOKEN |
(unset) | Sent as PRIVATE-TOKEN: … on GitLab update checks. Required for private GitLab repos. |
If the script's directory isn't writable, the loader falls back to $XDG_CACHE_HOME/zuv / %LOCALAPPDATA%\zuv / ~/.cache/zuv. Persistent volumes follow the same root.
How it works (1 paragraph)
The output is a PEP 723 script: metadata, a base85-encoded tar.xz of your project (_ZUV_PAYLOAD), and a tiny loader (_ZUV_LOADER) that verifies the sha256, extracts into .zuv/<stem>_<hash>/, and runs uv run --project <extracted> <entry>. Deps install at first run, so the bundle stays small.
Persistent storage (volumes)
Standard project layout
The recommended layout for a zuv-friendly project keeps source, persistent
data, and project metadata in clearly separated places:
myproject/
pyproject.toml # project metadata + [tool.zuv]
.python-version
src/ # all source code
main.py
api/
frontend/
data/ # persistent storage (declared as the volume)
With [tool.zuv] volume = "data", the data/ directory is mounted as a
persistent host folder at runtime, so anything the app writes there survives
rebuilds and version upgrades. Everything else under the project (sources,
lockfile, .venv) is treated as ephemeral and may be re-extracted between
versions.
Without a volume, every new build of a bundle extracts into a fresh .zuv/<stem>_<build_id>/ directory and the previous cache is garbage-collected on first run, so anything the app wrote inside its project tree is lost on upgrade.
Declare a volume in your project's pyproject.toml:
[tool.zuv]
volume = "data"
volumeis a relative path inside the project (no.., no absolute paths). One per project.- At runtime the loader mounts
<script_dir>/.zuv/<volume_path>/at<extracted>/<volume>via a symlink (POSIX) or junction (Windows, no admin / no Dev Mode required). - The host folder is persistent: it is not part of any
<stem>_<build_id>/cache, sozuv cleanand version upgrades leave it untouched. - App code keeps using the same relative path (e.g.
Path("data/app.db")); mounting is transparent.
Seeding (Docker-style): if your project ships content under <volume>/ (e.g. a default SQLite file), the first extraction promotes that content into the persistent volume. Subsequent versions never re-seed, so user data is preserved.
Cleanup:
zuv cleankeeps volumes.zuv clean --dataalso wipes volume directories.zuv volume wipe app.zuv.pywipes one bundle's volume.
Filesystem support: mounting needs a filesystem that allows symlinks (POSIX) or junctions (NTFS on Windows). It will fail on FAT32 / exFAT USB sticks, some SMB / network shares, and some VM shared folders. If the bundle lives on such a volume, set ZUV_CACHE_DIR to a path on a normal local disk (e.g. %LOCALAPPDATA%\zuv on Windows or ~/.cache/zuv on Linux/macOS); the volume will then mount under that path while the bundle itself stays on the original drive. If both fail, the loader prints a warning and the app runs without persistence (data stays inside the per-build extract dir and is lost on upgrade).
Caveat
Don't name your project the same as one of its dependencies (fastapi depending on fastapi confuses uv). Use fastapi-example or similar.
Examples
zuv build examples/bigtest && uv run dist/bigtest.zuv.py
zuv build examples/fastapi && uv run dist/fastapi.zuv.py
Metadata
Release files for zuv 0.5.6
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| zuv-0.5.6.tar.gz | 25.5 kB | With provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| zuv-0.5.6-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 57.2 kB
Release files / zuv-0.5.6.tar.gz
| Download URL | zuv-0.5.6.tar.gz |
|---|---|
| Size | 25.5 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
7f1ba0a10a767fce821132d56489fbc162ad03e2c5a873a5953851a1a80e148d
|
|
BLAKE2b-256 checksum How to use checksums |
2943fcc3fabefa0d7663a05dcc370a60321a2920349a8049c6440ce2452db984
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.12
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on May 27, 2026.
Transparency logRelease files / zuv-0.5.6-py3-none-any.whl
| Download URL | zuv-0.5.6-py3-none-any.whl |
|---|---|
| Size | 31.7 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
f074e91a265e5b5512dc14053a976bf5b1969163cc4df4bf314b66d9172af5ae
|
|
BLAKE2b-256 checksum How to use checksums |
aa995a6c321fa66aee5adb018fc9c0ae10ae3d3995bdfe05b8f19d0f3cc41784
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.12
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on May 27, 2026.
Transparency logSecurity for zuv 0.5.6
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Full provenance
All 2 files in this release have been uploaded with provenance metadata.
Attestation for zuv-0.5.6.tar.gz
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on May 27, 2026.
Transparency logA note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.