This fixes the issue where the runner is shutting down after installing libssl-dev.

Hey @MichaIng!

needrestart package is an essential component and should not be removed. The problem will resolve itself by updating the image.

It is not "essential", but "optional":

root@micha:~# apt show needrestart
Package: needrestart
Version: 3.6-8
Priority: optional

Stock Debian does not ship with needrestart, and generally, there is no problem for services to keep running (in memory), even when the underlying binary or shared library has changed (on disk). Else one can trigger a restart manually.

needrestart is mostly an informational package, to tell end users when it time to restart their system because of a kernel upgrade etc. Of course you do not need such info within and do not want to have the runner rebooting when this is done.

The problem will resolve itself by updating the image.

Yes, and it will re-appear as fast as any next OpenSSL upgrade is pushed to APT servers. So every once in a while all GitHub Actions workflows will fail until you push a new runner image. This isn't an acceptable situation.

@erik-bershel I'm confused, you say this will resolve itself when the libssl-dev ¹ update gets merged
into the image. So far so good, but this problem will reappear when they inevitably go out of sync on the
next libssl-dev update, breaking the image again for a few weeks?

What is the point of auto-rebooting a transient runner machine? Esp. when rebooting in this case means:
shutting down with a failure.