- The base image contains just `git` and `git-lfs` in a way that can be moved to and work from _any_ environment. `git-lfs` is statically compiled. Whilst `git` could be statically compiled (against musl), to enable it to work in any environment, this would prove problematic in FIPS based environments, where we want to load the system's `openssl`, which will have a certification against the system that it is installed against. For this reason, `git` will be bundled with the `glibc` it was compiled against, and if a system `libssl` is available, it will use that. We'll build a wrapper that will negotiate whether to use the bundled openssl lib, the system library, and also which version of `openssl` (1.1.* or 3.*). - Add gitlab-runner-helper to this base image. When `concrete` mode is therefore enabled, we'll bootstrap the runner helper binary as well as the git dependencies. This means when using `concrete`, the user provided helper image flavor will no longer be relevant (alpine or ubuntu).