I’m a DevOps engineer and a CKA. At Turkish Aerospace (TUSAS)
I built and ran containerized infrastructure on Kubernetes, led the move of application servers like Tomcat off
traditional VMs, and tuned the GitLab CI/CD that shipped it all. Before that, at ASELSAN, I got legacy software
that couldn’t be containerized running on Kubernetes anyway, with KubeVirt.
I think the best ops people understand the layer below the one they operate, so I went there on purpose.
I wrote a container runtime from raw namespaces and cgroups and a connection tracker in eBPF/XDP. I also
hardened an embedded RTOS kernel against radiation-induced bit flips with LLVM. Now I’m finishing a master’s thesis on kernel-bypass networking at Politecnico di Milano.
Off the terminal I play table tennis for AON Milano Sport in the Italian league.
role
DevOps engineer
studying
MEng, Politecnico di Milano
lang
Go · Python · Bash
likes
XDP, AF_XDP, eBPF, QUIC
based
Milano, IT · open to relocate
status
open to work
seeking
DevOps · platform · SRE
also
network software
L2 Data link · what connects everything
lsmod
Modules loaded into this engineer. Click one to see where it was used, at work or in projects.
ModuleAreaUsed by
L3 Network · how I got here
traceroute osman
traceroute to osman (present), 30 hops max, 60 byte packets
1BEng Computer Engineering@ Ankara University2018 – 2023
Graduated with a 3.81 / 4.0 GPA
Started working in industry during the degree, first as an intern at ASELSAN, then at TUSAS
2DevOps Intern@ ASELSANAug – Sep 2022
Ran legacy software that couldn’t be containerized on Kubernetes using KubeVirt, so VMs and containers shared one control plane
Thesis: kernel-bypass networking for a Media-over-QUIC relay (read more)
5* * * request timed out. Maybe your team is the next hop?send SYN →
L4 Transport · my master’s thesis
Thesis
Accelerating a Media-over-QUIC Relay with AF_XDP Kernel-Bypass Networking
Osman Bugra Dagli · Politecnico di Milano · Jan 2025 – present · in progress
Media over QUIC (MoQ) is an emerging IETF protocol for live media delivery, and relays sit at its core.
Every packet they forward passes through the kernel’s network stack. This thesis measures how much that
costs in Meta’s moxygen relay and removes it.
A perf-based CPU-time breakdown shows that kernel packet I/O takes a significant share of each core’s
time. I built an AF_XDP zero-copy fast path and connected it to the QUIC stack through a
non-invasive socket-injection seam, so the relay’s entire UDP RX/TX path runs over AF_XDP
with zero changes to the relay’s source.
single-core RX throughput (Mpps, higher is better)
kernel · recvmmsg + GRO (tuned)~0.65
AF_XDP · zero-copy~1.55
~2.4× per core
before: every packet through the kernel
NIC
driver · sk_buff
UDP stack
recvmmsg
QUIC
relay
after: kernel bypass
NIC
XDP redirect
UMEM (zero-copy)
AF_XDP socket
injection seam
QUIC
relay
Contributions
A perf-based pipeline that breaks down per-core CPU time along the relay’s data path
An AF_XDP zero-copy RX/TX path reaching ~1.55 Mpps on one core, against ~0.65 Mpps for a tuned kernel baseline (recvmmsg + GRO)
A socket-injection seam, built on proxygen’s socket factory, that moves the relay onto AF_XDP without the relay knowing
A reproducible CloudLab testbed: one profile provisions the machines, applies the patch series to moxygen and proxygen, syncs clocks with PTP for one-way latency, and runs the fan-out, throughput and flame-graph experiments
Things I built to see how they work. Filter with the lsmod table above.
Radiation-hardening Miosix
LLVM · STM32 · 2026
In orbit, a charged particle can flip a bit in a register or in RAM. That’s a single-event upset,
and the code keeps running on a wrong value. ASPIS is an LLVM plugin from Politecnico di Milano’s HEAPLab
that hardens code against this at the IR level. I integrated it into the build of Miosix, an embedded
RTOS, so the kernel itself compiles hardened for an STM32F407.
Try it: click any bit of x to hit it with a cosmic ray. EDDI keeps a shadow copy of every value and compares the two before the value is used.
x0x2A
x′ shadow0x2A
icmp eq x, x′ is true, so execution continues.
C / C++
clangemits LLVM IR
llvm-link
ASPIS passesEDDI + CFCSS
codegen
.elf → .binobjcopy
STM32F407
A CMake module that sends any target through the clang → opt → link pipeline and skips assembly files automatically
Every pass can be picked from the build script: data duplication (eddi, reddi, seddi, fdsc) and control-flow checking (cfcss, rasm, inter-rasm, racfed)
Compiled the whole kernel through ASPIS, then moved to selective hardening with annotations on the scheduler
A clang toolchain file that can point at any LLVM install, plus an objcopy step that produces a flashable .bin
containerrt
Go · Mar 2026
A minimal container runtime written from scratch on raw Linux primitives, with no runc and no libcontainer.
I wanted to know exactly what docker run does before the process starts.
clone()NEWUTS · NEWPID · NEWNS
pivot_roothost root fully unmounted
tmpfs /devessential device nodes
cgroup v2limits applied by parent
pipe barrierchild waits for setup
exec
Isolation with UTS, PID and mount namespaces
pivot_root instead of chroot: the host root is unmounted, not just hidden
An ephemeral /dev tmpfs with only the essential device nodes
A pipe-based sync barrier between parent and child ensures the workload starts inside its cgroup v2 limits and can’t race the setup
A real init: reaps zombies, forwards SIGINT/SIGTERM, and exits with the workload’s code (128 + signal)
Tested with escape attempts, pids.current monitoring and OOM kills under memory.max
conntracker
eBPF/XDP · May 2025
Connection tracking and TCP fingerprinting that runs in the kernel at XDP, before the network
stack ever allocates an sk_buff.
TCP and UDP state machines in eBPF, tracking per-connection metrics
Extracts TCP option sequences (MSS, SACK, timestamps, window scale) for OS and stack fingerprinting
A user-space daemon in C loads a YAML config, attaches the program, and serves stats and the ban list over HTTP
Count-Min sketch and Bloom filters for fast threshold-triggered filtering in bounded memory
cd2alloy
Python · formal methods
Turns UML class diagrams into Alloy models, so a design can be model-checked instead of only
reviewed. Draw the diagram in PlantUML, export XMI, and open the generated .als in the Alloy Analyzer.
XMI reader → class model (classes, association classes, enums) → Alloy translator
Chooses between Alloy base libraries depending on whether the diagram uses enums and attribute values
Checked against real Software Engineering 2 exam solutions
cloud-storage
Go · HTTP/3
A self-hosted file server over HTTP/3 / QUIC. TCP+TLS and QUIC/UDP share one port.
Browsers arrive over TCP, see Alt-Svc and upgrade themselves.
Filenames hardened against traversal and control/NUL bytes
Collision-safe writes that never overwrite a file
API-key auth middleware; the server refuses to start without a key
L6 Presentation · same data, different encodings
iconv
The presentation layer translates between formats. Here’s me in a few of them.
$ iconv -f osman -t <locale>
tr_TR.UTF-8Türkçenative
en_US.UTF-8Englishprofessional
it_IT.UTF-8ItalianoB1, improving daily
$ openssl x509 -in osman.crt -noout -text
Subject: CN = Osman Bugra Dagli
Issuer: O = The Linux Foundation, OU = CNCF
X509v3 Extended Key Usage:Certified Kubernetes Administrator (CKA)Verify return code:0 (ok)
$ iconv -f osman -t application/pdf > cv.pdf
The same story on one page, for people who prefer paper.