Frame 1 · captured just now · uptime 0s

Osman Bugra Dagli

DevOps engineer who likes the layers underneath.

I'm a DevOps engineer in Milan. I keep infrastructure running, and I like finding out how it works underneath: Linux, networking, and the kernel.

Dissect this packet ↓

tcpdump -i eth0 -nn 'host osman' 0 packets

L1 Physical · the actual hardware

whoami

I'm a DevOps engineer and a CKA. At Turkish Aerospace (TUSAS) I built and ran containerized infrastructure on Kubernetes, led the move of application servers like Tomcat off traditional VMs, and tuned the GitLab CI/CD that shipped it all. Before that, at ASELSAN, I got legacy software that couldn't be containerized running on Kubernetes anyway, with KubeVirt.

I think the best ops people understand the layer below the one they operate, so I went there on purpose. I wrote a container runtime from raw namespaces and cgroups and a connection tracker in eBPF/XDP. I also hardened an embedded RTOS kernel against radiation-induced bit flips with LLVM. Now I'm finishing a master's thesis on kernel-bypass networking at Politecnico di Milano.

Off the terminal I play table tennis for AON Milano Sport in the Italian league.

role: DevOps engineer
studying: MEng, Politecnico di Milano
lang: Go · Python · Bash
likes: XDP, AF_XDP, eBPF, QUIC
based: Milano, IT · open to relocate
status: open to work
seeking: DevOps · platform · SRE
also: network software

L2 Data link · what connects everything

lsmod

Modules loaded into this engineer. Click one to see where it was used, at work or in projects.

ModuleAreaUsed by

L3 Network · how I got here

traceroute osman

traceroute to osman (present), 30 hops max, 60 byte packets

1 BEng Computer Engineering @ Ankara University 2018 – 2023
- Graduated with a 3.81 / 4.0 GPA
- Started working in industry during the degree, first as an intern at ASELSAN, then at TUSAS
2 DevOps Intern @ ASELSAN Aug – Sep 2022
- Ran legacy software that couldn't be containerized on Kubernetes using KubeVirt, so VMs and containers shared one control plane
3 DevOps Engineer @ Turkish Aerospace (TUSAS) Nov 2022 – Sep 2024
- Built and maintained containerized infrastructure on Kubernetes
- Led the migration of application servers (e.g. Tomcat) from OS-based deployments to Kubernetes
- Troubleshot and optimized GitLab CI/CD pipelines for integration and deployment
- Wrote Bash and Python automation that took repetitive work off the team
4 MEng @ Politecnico di Milano Sep 2024 – Dec 2026
- Coursework: Network Computing, Computing Infrastructures, Advanced OS, Advanced Algorithms, IoT
- Thesis: kernel-bypass networking for a Media-over-QUIC relay (read more)
5 * * * request timed out. Maybe your team is the next hop? send SYN →

L4 Transport · my master's thesis

Thesis

Accelerating a Media-over-QUIC Relay with AF_XDP Kernel-Bypass Networking

Osman Bugra Dagli · Politecnico di Milano · Jan 2025 – present · in progress

Media over QUIC (MoQ) is an emerging IETF protocol for live media delivery, and relays sit at its core. Every packet they forward passes through the kernel's network stack. This thesis measures how much that costs in Meta's moxygen relay and removes it.

A perf-based CPU-time breakdown shows that kernel packet I/O takes a significant share of each core's time. I built an AF_XDP zero-copy fast path and connected it to the QUIC stack through a non-invasive socket-injection seam, so the relay's entire UDP RX/TX path runs over AF_XDP with zero changes to the relay's source.

single-core RX throughput (Mpps, higher is better)

kernel · recvmmsg + GRO (tuned) ~0.65

AF_XDP · zero-copy ~1.55

~2.4× per core

before: every packet through the kernel

NIC
driver · sk_buff
UDP stack
recvmmsg
QUIC
relay

after: kernel bypass

NIC
XDP redirect
UMEM (zero-copy)
AF_XDP socket
injection seam
QUIC
relay

Contributions

A perf-based pipeline that breaks down per-core CPU time along the relay's data path
An AF_XDP zero-copy RX/TX path reaching ~1.55 Mpps on one core, against ~0.65 Mpps for a tuned kernel baseline (recvmmsg + GRO)
A socket-injection seam, built on proxygen's socket factory, that moves the relay onto AF_XDP without the relay knowing
A reproducible CloudLab testbed: one profile provisions the machines, applies the patch series to moxygen and proxygen, syncs clocks with PTP for one-way latency, and runs the fan-out, throughput and flame-graph experiments

Testbed and patches ↗ moxygen fork ↗

L5 Session · where my own time goes

Projects

Things I built to see how they work. Filter with the lsmod table above.

Radiation-hardening Miosix

LLVM · STM32 · 2026

In orbit, a charged particle can flip a bit in a register or in RAM. That's a single-event upset, and the code keeps running on a wrong value. ASPIS is an LLVM plugin from Politecnico di Milano's HEAPLab that hardens code against this at the IR level. I integrated it into the build of Miosix, an embedded RTOS, so the kernel itself compiles hardened for an STM32F407.

Try it: click any bit of x to hit it with a cosmic ray. EDDI keeps a shadow copy of every value and compares the two before the value is used.

x 0x2A

x′ shadow 0x2A

icmp eq x, x′ is true, so execution continues.

C / C++
clangemits LLVM IR
llvm-link
ASPIS passesEDDI + CFCSS
codegen
.elf → .binobjcopy
STM32F407

A CMake module that sends any target through the clang → opt → link pipeline and skips assembly files automatically
Every pass can be picked from the build script: data duplication (eddi, reddi, seddi, fdsc) and control-flow checking (cfcss, rasm, inter-rasm, racfed)
Compiled the whole kernel through ASPIS, then moved to selective hardening with annotations on the scheduler
A clang toolchain file that can point at any LLVM install, plus an objcopy step that produces a flashable .bin

containerrt

Go · Mar 2026

A minimal container runtime written from scratch on raw Linux primitives, with no runc and no libcontainer. I wanted to know exactly what docker run does before the process starts.

clone()NEWUTS · NEWPID · NEWNS
pivot_roothost root fully unmounted
tmpfs /devessential device nodes
cgroup v2limits applied by parent
pipe barrierchild waits for setup
exec

Isolation with UTS, PID and mount namespaces
pivot_root instead of chroot: the host root is unmounted, not just hidden
An ephemeral /dev tmpfs with only the essential device nodes
A pipe-based sync barrier between parent and child ensures the workload starts inside its cgroup v2 limits and can't race the setup
A real init: reaps zombies, forwards SIGINT/SIGTERM, and exits with the workload's code (128 + signal)
Tested with escape attempts, pids.current monitoring and OOM kills under memory.max

conntracker

eBPF/XDP · May 2025

Connection tracking and TCP fingerprinting that runs in the kernel at XDP, before the network stack ever allocates an sk_buff.

TCP and UDP state machines in eBPF, tracking per-connection metrics
Extracts TCP option sequences (MSS, SACK, timestamps, window scale) for OS and stack fingerprinting
A user-space daemon in C loads a YAML config, attaches the program, and serves stats and the ban list over HTTP
Count-Min sketch and Bloom filters for fast threshold-triggered filtering in bounded memory

cd2alloy

Python · formal methods

Turns UML class diagrams into Alloy models, so a design can be model-checked instead of only reviewed. Draw the diagram in PlantUML, export XMI, and open the generated .als in the Alloy Analyzer.

XMI reader → class model (classes, association classes, enums) → Alloy translator
Chooses between Alloy base libraries depending on whether the diagram uses enums and attribute values
Checked against real Software Engineering 2 exam solutions

cloud-storage

Go · HTTP/3

A self-hosted file server over HTTP/3 / QUIC. TCP+TLS and QUIC/UDP share one port. Browsers arrive over TCP, see Alt-Svc and upgrade themselves.

Filenames hardened against traversal and control/NUL bytes
Collision-safe writes that never overwrite a file
API-key auth middleware; the server refuses to start without a key

L6 Presentation · same data, different encodings

iconv

The presentation layer translates between formats. Here's me in a few of them.

$ iconv -f osman -t <locale>

tr_TR.UTF-8Türkçenative

en_US.UTF-8Englishprofessional

it_IT.UTF-8ItalianoB1, improving daily

$ openssl x509 -in osman.crt -noout -text

Subject: CN = Osman Bugra Dagli
Issuer:  O = The Linux Foundation, OU = CNCF
X509v3 Extended Key Usage:
    Certified Kubernetes Administrator (CKA)
Verify return code: 0 (ok)

$ iconv -f osman -t application/pdf > cv.pdf

The same story on one page, for people who prefer paper.

Download CV (PDF)

L7 Application · what's running right now

ps aux | grep now

PIDSTATCOMMAND

1550Rwriting up the AF_XDP thesis, graduating Dec 2026

4433Rhardening cloud-storage: streaming uploads, quotas, tests

8080Rlooking for DevOps, platform or SRE roles, and network software roles close to my thesis. Milano or relocation.

1100Spracticing with AON Milano Sport for the next table tennis league match

SYN Open a connection

Three-way handshake

→SYNYou send a message. Roles, collaboration, or just a good packet capture.
←SYN-ACKI reply, usually within a day.
→ACKConnection ESTABLISHED.

osman.dagli687@gmail.com GitHub ↗ LinkedIn ↗ CV.pdf ↓