Updated the Global Bundle with the content of  https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem -O rds-combined-ca-bundle.pem
This is the new URL to be used, as described on https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL.html



The new bundle:
- removes expired root certificates
- keeps certificates for `rds-ca-2019`
- adds certificates for all regions for
  - `rds-ca-rsa2048-g1`: certificate authority with RSA 2048 private key algorithm and SHA256 signing algorithm
  - `rds-ca-rsa4096-g1`: certificate authority with RSA 4096 private key algorithm and SHA384 signing algorithm
  - `rds-ca-ecc384-g1`: certificate authority with ECC 384 private key algorithm and SHA384 signing algorithm

It fixes #32017 and #27790

Co-authored-by: Théophile Helleboid <theophile.helleboid.ext@qonto.com>

* Add fonts in Dockerfile to fix pulses (#31764)

Add Noto fonts in Alpine Dockerfile

* Fix Docker build command

---------

Co-authored-by: Luis Paolini <paoliniluis@gmail.com>

This reverts commit 44de976d.

Add Noto fonts in Alpine Dockerfile

* Build experimental multi-arch docker image (partially #13119)

As the user in https://github.com/metabase/metabase/pull/14585#discussion_r922696696 quickly noticed, the key value syntax in Dockerfiles is legacy and also we shouldn't use it with more than 1 key. This didn't make any effect as the base image had our Env keys already there, but if there's a change at some point, we might end up with weird env settings

* Fix locking in new Alpine release container
Seems like the new Alpine container (3.15) has some issue when doing apk upgrade first which ends up erroring out the process, so moving it to the last part of the process (after installing the packages) makes the trick.
You can test it out by using the current process (errors with a "Unable to lock database: temporary error (try again later)") and the one in this branch which will finish successfully

* Switch to Temurin official image

This image is a pure musl alpine image

We had some CI breaks that are predicated on the year changing. Fix them.

* Add checks for _FILE env vars

* Fixing this for once and for all + documenting

* Update run_metabase.sh

* Separate steps for faster build

* Fix typo

* Update .ebextensions to send memory usage to Cloudwatch and also install inspector agent to actively monitor threats. Added full Cloudwatch agent with metrics config, simplified config file. Fix #9021

* Adding a few items to documentation

* Apply suggestions from code review

Co-authored-by: Jeff Bruemmer <jeff@metabase.com>

* Add a few more changes to finish this PR

Co-authored-by: Jeff Bruemmer <jeff@metabase.com>

* Add container build for metabase-enterprise-head

* Add build argument

* Delete script to build images

This will make the JVM output more details as it crashes for running out of memory.

New output:

```text
rroland@tardis:~/src/metabase/target/uberjar$ java -Xmx50m -XX:+CrashOnOutOfMemoryError -jar metabase.jar
WARNING: sun.reflect.Reflection.getCallerClass is not supported. This will impact performance.
2021-02-25 11:38:31,689 INFO metabase.util :: Maximum memory available to JVM: 50.0 MB
Aborting due to java.lang.OutOfMemoryError: Java heap space
\#
\# A fatal error has been detected by the Java Runtime Environment:
\#
\#  Internal Error (debug.cpp:338), pid=40255, tid=40256
\#  fatal error: OutOfMemory encountered: Java heap space
\#
\# JRE version: OpenJDK Runtime Environment (11.0.10+9) (build 11.0.10+9-post-Debian-1)
\# Java VM: OpenJDK 64-Bit Server VM (11.0.10+9-post-Debian-1, mixed mode, sharing, tiered, compressed oops, g1 gc, linux-amd64)
\# No core dump will be written. Core dumps have been disabled. To enable core dumping, try "ulimit -c unlimited" before starting Java again
\#
\# An error report file with more information is saved as:
\# /home/rroland/src/metabase/target/uberjar/hs_err_pid40255.log
\#
\# If you would like to submit a bug report, please visit:
\#   https://bugs.debian.org/openjdk-11
\#
Aborted
```

Previous output:

```text
rroland@tardis:~/src/metabase/target/uberjar$ java -Xmx50m -XX:+ExitOnOutOfMemoryError -jar metabase.jar
WARNING: sun.reflect.Reflection.getCallerClass is not supported. This will impact performance.
2021-02-25 11:38:46,898 INFO metabase.util :: Maximum memory available to JVM: 50.0 MB
Terminating due to java.lang.OutOfMemoryError: Java heap space
```

* Trim packages and update

- Removed the make and wget dependency
- Made the release container to auto-update
- Adds are now a curl in a single command to reduce intermediate images
- consecutive run commands into 1 line
- ENVs to 1 line to reduce intermediate images

* Update the docker file for the releases

Co-authored-by: Cam Saul <1455846+camsaul@users.noreply.github.com>

Enable the OOM killer, which will allow Docker / Kubernetes / ECS to restart a container when an OOM occurs

* Change font registration to run on first Pulse PNG render rather than at launch.
    * This will improve startup times slightly . 
    * This was causing DockerHub builds for `metabase-head` to fail 
because the stage 1 "builder" image did not have `ttf-dejavu` and `fontconfig` installed (the builder was running in to #12223).
     * This will resolve issues discussed in #12223 where Metabase fails to launch when running on a "headless" JVM Docker image (i.e., one without AWT libraries) or when we run into the infamous font issues. We still won't be able to render Pulses, but Metabase without Pulses is slightly preferable to no Metabase at all
*  Improved error messages & logging when Pulse rendering fails. Unfortunately, if the AWT classes are unavailable/broken in the JVM there is no way we can render Pulses given our current reliance on it. The best we can do is explain the situation and point people in the right direction. The new error message explains the situation and points people to #7986 for more details and workarounds.  As such, I am going to close #7986 because we cannot fix the underlying issue itself so the best we do is handle it better.
*  Refactor tests in `metabase.api.pulse-test`
*  Add tests for `GET /api/pulse/preview_card/:id`
*  Include entire Exception chain in 500 responses
*  Fix font registration logic not cleaning up `InputStream`s when done with them, wasting memory
*  Minor Dockerfile tweaks

* Change font registration to run on first Pulse PNG render rather than at launch.
    * This will improve startup times slightly . 
    * This was causing DockerHub builds for `metabase-head` to fail 
because the stage 1 "builder" image did not have `ttf-dejavu` and `fontconfig` installed (the builder was running in to #12223).
     * This will resolve issues discussed in #12223 where Metabase fails to launch when running on a "headless" JVM Docker image (i.e., one without AWT libraries) or when we run into the infamous font issues. We still won't be able to render Pulses, but Metabase without Pulses is slightly preferable to no Metabase at all
*  Improved error messages & logging when Pulse rendering fails. Unfortunately, if the AWT classes are unavailable/broken in the JVM there is no way we can render Pulses given our current reliance on it. The best we can do is explain the situation and point people in the right direction. The new error message explains the situation and points people to #7986 for more details and workarounds.  As such, I am going to close #7986 because we cannot fix the underlying issue itself so the best we do is handle it better.
*  Refactor tests in `metabase.api.pulse-test`
*  Add tests for `GET /api/pulse/preview_card/:id`
*  Include entire Exception chain in 500 responses
*  Fix font registration logic not cleaning up `InputStream`s when done with them, wasting memory
*  Minor Dockerfile tweaks

Avoids `ls: /app/initial*.db: No such file or directory` messages in logs
when no initial db is present.

* Load initial Docker Metabase db from provided H2 dump

* Move H2 init db to /app and add `mv.db` extension

* Remove `COPY` of init db in Dockerfile in favor of volume

* Document how to mount initial db in container

* Don't load H2 db into a populated db

* Add example Dockerfile that copies in initialization db

* Compute Content-Security-Policy hashes for inline JS (#10504)

* Split out inline JS from index/init templates to separate files

* Read inline JS from resources at run time

* Calculate inline JS hashes for CSP header from content

* Move inline JS to resource sub-directory

* Update and memoize inline JS loading

* Revert debug code

* Deduplicate `resp/response` calls

* Fix paths to moved inline JS resources

* Force creation of test data DB so things don't get left in the cache

This fix was provided by @camsaul.

* Combine and `defonce` inline JS hashes

* s/inlinejs/inline-js/

* Ensure that Metabase JAR is readable by `metabase` container user (#10510)

If the umask of the user that builds the image is xx7, the JAR will not be
world readable in the resulting image.

* Remove `--add-modules=java.xml.bind` Java option (#10521)

Fixes #10244. @camsaul confirmed that it is no longer needed.

* Join on collection table's ID, not the joining table's `collection_id` (#10481)

* Join on collection table's ID, not the joining table's `collection_id`

This caused each record that joins on collection, to be duplicated for each
existing collection:

`LEFT JOIN collection collection ON card.collection_id = collection_id`

should be

`LEFT JOIN collection collection ON card.collection_id = collection.id`

* Test fixes from @cam on EE

* Insights: correctly handle infinities in results (#10502)

Filter out models with infinities

* Transfer log events as JSON objects and allow filtering on front-end (#10522)

* Return log events as JSON objects from API; render on front-end

Site UUID added to log events.

* Remove superfluous memoization of site UUID retrieval

Settings are already cached.

* Transfer timestamps in ISO-8601 format

* Move `metabase.metabot.instance/local-process-uuid` to `metabase.public-settings`

* Use `local-process-uuid` in stead of `site-uuid`

`site-uuid` is not unique across processes, which is what we want to
associate with log events.

* Remove unused import

* Allow log events to be filtered by process UUID on front-end

* Move process selector out of loading wrapper

Otherwise, if there are process UUIDs with no log events, the selector is
removed with the log event list.

* Figured out how to add docs to `defonce`

* Fix ns declaration

* Linter appeasement

* Merge log events received from back-end with previously received ones

This allows responses from multiple back-end instances to be spliced
together.

* Use MB components in stead of plain, styled HTML tags

The select is only displayed if more than one process UUID was found.

* Linter appeasement

* Move `metabase.public-settings/local-process-uuid` to `metabase.config`

* Fix sorting on multiple log event fields

* Flatten `Select` children to allow nested arrays of children

* Generate options directly under parent Select

* Limit the number of log events that we render

* Docstring and style updates

* Update editor config with Clojure files max line length

* Ensure that `NumericWrapper` is imported before use

* Cleanup layout

* Bump HoneySQL version (#10559)

The new version (0.9.5) includes @camsaul's Turkish upper case fix:
jkk/honeysql#237

* Factor out test for access to localStorage (#10533)

* Factor out test for access to localStorage

This allows code that uses localStorage to test against
`window.hasLocalStorage`, in stead of handling exceptions generated when
access to localStorage is denied.

* Move check for localStorage to metabase/lib/dom

* Fix typo in warning message (#10556)

* revert text color to #74838f (#10560)

* revert text-medium color to #74838f

* use light instead of medium on preview button

* MBTL (#10105)

Add transforms and domain models

* Added page about maps and updated nav (#10495)

* Added page about maps and updated nav

* Clarified step 1

* Added more details throughout

* Quick URL change

* Added additional resource!

* fix typo: 'sdisplay' to 'display'

* Add message with link to docs for fields without any filter widgets (#10340)

* Correct proxy command line [ci skip] (#10430)

* Bump Toucan version to include Turkish lower case fix (#10581)

* Wrap `tru` and `trs` macro results in `str` (#10571)

* Add versions of `trs` and `tru` that wrap results in `str`

The pre-existing `trs` and `tru` were renamed to `lazy-trs` and `lazy-tru`
respectively, and new `trs` and `tru` funcs were added, wrapping the result
of its lazy counterpart in `str`.

This way the normal use case of `trs` and `tru` is improved by no longer
requiring that it be wrapped in `str`.

Cases where the translated result is passed to `str` anyway, the lazy
version can be used.

* `(str (trs ...))` → `(trs ...)`

And the same for `tru`.

* Allow `defsetting` descriptions to use lazy versions of `trs`/`tru`

* Use `lazy-trs`/`lazy-tru` where `str` is applied separately

* Remove unnecessary `vec` from `tru`/`trs` macros

* puppetlabs.i18n does not have a `lazy-tru`

* Missed some settings that now need to use `lazy-tru`

* Only use `lazy-tru` in top-level `def`s

If the localized strings are looked up on module import, before locales are
loaded, the lookup will fail and the original input string will be used.

* Fix bad usages of `tru` that should be `lazy-tru`

* s/lazy-tr/deferred-tr/g

* Avoid `tr*` macros being used in top-level (compile time) statements

Because localizations are not yet loaded at compile time.

* Add type hint for `str*` wrapping of `trs`/`tru`

* Fix assigned function's return type hint

* Expand docstrings for `i18n/tr[su]`

* Use `trs` and `tru` from metabase.util.i18n instead of puppetlabs.i18n.core

* Defer compile time translation lookups

These changes were pointed out by exceptions generated by `i18n/str*`.

* Remove unused `require`d function

* New compile time `trs` usages caught by `lein uberjar`

* Ensure that error message from db driver is a string

It is necessary to ensure that the error message is a string, because some
db driver errors come from statically declared error messages, using
`deferred-tru`. Like those in
`metabase.driver.common/connection-error-messages`.

Fixes #10347 and #10473.

* Remove string type hint from `humanize-connect-error-message`

* Don't disable preview for fields with non-trivial type  (#9687)

* Don't create API callback if no database is associated with card (#10573)

* Don't create API callback if no database is associated with card

Fixes #10538

* Return empty array to avoid mapping over null

If the umask of the user that builds the image is xx7, the JAR will not be
world readable in the resulting image.

The `/bin/docker/Dockerfile` is the actual file used to build the actual released Docker images at https://hub.docker.com/r/metabase/metabase/.

The root folder `Dockerfile` is the one used for building https://hub.docker.com/r/metabase/metabase-head/ (that is, those we're built until the issue in https://github.com/metabase/metabase/issues/8444 appeared)