I’m a DevOps engineer and a CKA. At Turkish Aerospace (TUSAS)
I built and ran containerized infrastructure on Kubernetes, led the move of application servers like Tomcat off
traditional VMs, and tuned the GitLab CI/CD that shipped it all. Before that, at ASELSAN, I got legacy software
that couldn’t be containerized running on Kubernetes anyway, with KubeVirt.
I think the best ops people understand the layer below the one they operate, so I went there on purpose.
I wrote a container runtime from raw namespaces and cgroups, and a connection tracker in eBPF/XDP. I also
built an embedded RTOS kernel with ASPIS, an LLVM-based tool that hardens code against radiation-induced bit flips. Now I’m finishing a master’s thesis on kernel-bypass networking at Politecnico di Milano.
Off the terminal I play table tennis for AON Milano Sport in the Italian league.
role
DevOps engineer
studying
MEng, Politecnico di Milano
lang
Go · Python · Bash
likes
XDP, AF_XDP, eBPF, QUIC
based
Milano, IT · open to relocate
status
open to work
seeking
DevOps · platform · SRE
also
network software
L2 Data link · what connects everything
lsmod
Modules loaded into this engineer. Click one to see where it was used, at work or in projects.
ModuleAreaUsed by
L3 Network · how I got here
traceroute osman
traceroute to osman (present), 30 hops max, 60 byte packets
1BEng Computer Engineering@ Ankara University2018 – 2023
Graduated with a 3.81 / 4.0 GPA
Started working in industry during the degree, first as an intern at ASELSAN, then at TUSAS
2DevOps Intern@ ASELSANAug – Sep 2022
Used KubeVirt to run legacy software that couldn’t be containerized as VMs on Kubernetes, so VMs and containers shared one control plane
Thesis: kernel-bypass networking for a Media-over-QUIC relay (read more)
5* * * request timed out. Maybe your team is the next hop?send SYN →
L4 Transport · my master’s thesis
Thesis
Accelerating a Media-over-QUIC Relay with AF_XDP Kernel-Bypass Networking
Osman Bugra Dagli · Politecnico di Milano · Jan 2025 – present
Media over QUIC (MoQ) is an emerging IETF protocol for live media delivery, and relays sit at its core.
Every packet they forward passes through the kernel’s network stack. This thesis measures how much that
costs in Meta’s moxygen relay and takes the kernel out of that path.
A perf-based CPU-time breakdown shows that the relay is CPU-bound on a single core, at about 1% of
the NIC’s 100 Gbit/s line rate, and that kernel packet I/O takes 16–29% of that core’s busy time.
I built an AF_XDP fast path and connected it to the QUIC stack through a
socket-injection seam: the point where the server chooses which UDP sockets QUIC uses. The relay’s entire
UDP RX/TX path now runs over AF_XDP without changing the relay’s forwarding logic; the only
server change is a few lines, behind a flag, that install the AF_XDP socket factory.
The headroom was measured first, with a receive-path microbenchmark on the same hardware and no per-packet
application work: on one core, AF_XDP zero-copy receives about 2.4× more packets per second
than a tuned kernel path.
receive-path microbenchmark, one core (million packets/s · 1500-byte UDP · no per-packet work · Intel E810)
kernel · recvmmsg + GRO (tuned)~0.65
AF_XDP · zero-copy~1.55
~2.4× per core
before: every packet through the kernel
NIC
driver · sk_buff
UDP stack
recvmmsg
QUIC
relay
after: kernel bypass
NIC
XDP redirect
UMEM (zero-copy)
AF_XDP socket
injection seam
QUIC
relay
Contributions
A perf-based pipeline that breaks down per-core CPU time along the relay’s data path
A receive-path microbenchmark on the testbed hardware: AF_XDP zero-copy reaches ~1.55 Mpps on one core, against ~0.65 Mpps for a tuned kernel path (recvmmsg + GRO)
An AF_XDP RX/TX path for the relay, in a new xdp/ module of moxygen
A socket-injection seam, built on proxygen’s socket factory, that moves the relay onto AF_XDP while its forwarding logic stays unchanged
A reproducible CloudLab testbed: one profile provisions the machines, applies the patch series to moxygen and proxygen, syncs clocks with PTP for one-way latency, and runs the fan-out, throughput and flame-graph experiments
Things I built to see how they work. Filter with the lsmod table above.
Radiation-hardening Miosix
LLVM · STM32 · 2026
In orbit, a charged particle can flip a bit in a register or in RAM. That’s a single-event upset,
and the code keeps running on a wrong value. ASPIS is an LLVM plugin from Politecnico di Milano’s HEAPLab
that hardens code against this at the level of LLVM’s intermediate representation (IR). I integrated it into the build of Miosix, an embedded
RTOS, so the kernel itself compiles hardened for an STM32F407.
Try it: click any bit of x to hit it with a cosmic ray. EDDI (error detection by duplicated instructions) keeps a shadow copy of every value and compares the two before the value is used.
x0x2A
x′ shadow0x2A
icmp eq x, x′ is true, so execution continues.
C / C++
clangemits LLVM IR
llvm-link
ASPIS passesEDDI + CFCSS
codegen
.elf → .binobjcopy
STM32F407
A CMake module that sends any target through the clang → opt → link pipeline and skips assembly files automatically
Every pass can be picked from the build script: data duplication (eddi, reddi, seddi, fdsc) and control-flow checking (cfcss, rasm, inter-rasm, racfed)
Compiled the whole kernel through ASPIS, then moved to selective hardening with annotations on the scheduler
A clang toolchain file that can point at any LLVM install, plus an objcopy step that produces a flashable .bin
containerrt
Go · Mar 2026
A minimal container runtime written from scratch on raw Linux primitives, with no runc and no libcontainer.
I wanted to know exactly what docker run does before the process starts.
clone()NEWUTS · NEWPID · NEWNS
pivot_roothost root fully unmounted
tmpfs /devessential device nodes
cgroup v2limits applied by parent
pipe barrierchild waits for setup
exec
Isolation with UTS, PID and mount namespaces
pivot_root instead of chroot: the host root is unmounted, not just hidden
An ephemeral /dev tmpfs with only the essential device nodes
A pipe-based sync barrier between parent and child ensures the workload starts inside its cgroup v2 limits and can’t race the setup
A real init: reaps zombies, forwards SIGINT/SIGTERM, and exits with the workload’s code (128 + signal)
Tested with escape attempts, pids.current monitoring and OOM kills under memory.max
conntracker
eBPF/XDP · May 2025
Connection tracking and TCP fingerprinting that run in the kernel at XDP, before the network
stack ever allocates an sk_buff.
TCP and UDP state machines in eBPF, tracking per-connection metrics
Extracts TCP option sequences (MSS, SACK, timestamps, window scale) for OS and stack fingerprinting
A user-space daemon in C loads a YAML config, attaches the program, and serves stats and the ban list over HTTP
Count-Min sketch and Bloom filters for fast threshold-triggered filtering in bounded memory
cd2alloy
Python · formal methods
Turns UML class diagrams into Alloy models, so a design can be model-checked instead of only
reviewed. Draw the diagram in PlantUML, export XMI, and open the generated .als in the Alloy Analyzer.
XMI reader → class model (classes, association classes, enums) → Alloy translator
Chooses between Alloy base libraries depending on whether the diagram uses enums and attribute values
Checked against real Software Engineering 2 exam solutions
cloud-storage
Go · HTTP/3
A self-hosted file server over HTTP/3 (QUIC). TCP+TLS and QUIC/UDP share one port.
Browsers arrive over TCP, see Alt-Svc and upgrade themselves.
Filenames hardened against traversal and control/NUL bytes
Collision-safe writes that never overwrite a file
API-key auth middleware; the server refuses to start without a key
L6 Presentation · same data, different encodings
iconv
The presentation layer translates between formats. Here’s me in a few of them.
$ iconv -f osman -t <locale>
tr_TR.UTF-8Türkçenative
en_US.UTF-8Englishprofessional
it_IT.UTF-8ItalianoB1, improving daily
$ openssl x509 -in osman.crt -noout -text
Subject: CN = Osman Bugra Dagli
Issuer: O = The Linux Foundation, OU = CNCF
X509v3 Extended Key Usage:Certified Kubernetes Administrator (CKA)Verify return code:0 (ok)
$ iconv -f osman -t application/pdf > cv.pdf
The same story on one page, for people who prefer paper.