OSSO B.V.

OSSO ondersteunt op het gebied van ICT-infrastructuur en softwareontwikkeling

About

About OSSO

OSSO specializes in open source {hosting,​network,​cloud} infrastructure, development and operations. Covering network, system and software engineering (incl. {dev,​netdev,​sys,​sec}​ops).

In depth experience with high availability, multi datacenter setups and being able to combine the expertise from the different domains in our services. Among our customers we count ISP’s, SaaS/cloud services and tech-startups. The support we offer our customers ranges from occasional support requests, 24/7 support and kickstarting new infrastructures, to fully handling operations and providing hosting.

Specialized hosting

  • High Available
  • Multi site
  • Performant
  • 10G/25G/100G network
(details) →

24/7 Operations

  • Incident response
  • Active monitoring
  • SRE (Site Reliability Engineering)
(details) →

Managed Kubernetes

  • Cluster management / operations
  • Developer and implementation support
  • Batteries included
(details) →
Read more about the people at OSSO

Features

Engineering

  • Cloud/ISP infrastructure
  • High Availabity
  • Open Networking
  • Open Source

Information Security

  • Security minded
  • ISMS ISO 27001:2022 certified
  • ISMS NEN 7510:2017 certified

Independent infrastructure

  • AS43366 IP network
  • Datacenter/POP list
  • 25G/100G Open Networking

Blog

Go to our blog

openvpn dco / mtu / mss clamping / packet fragmentation

Since we switched OpenVPN to the in-kernel data channel (DCO, ovpn module), traffic through the tunnel produced oversized outer UDP datagrams that got IP-fragmented. Fixed in two steps: MSS clamping in mangle on the vpn-server interface (TCP: MSS 1460 → 1400). tun-mtu 1440 in the OpenVPN config, for everything MSS clamping can't touch (QUIC, VPN-in-VPN). Verified with a bpftrace script that counts IPv4 fragments and oversized GRO segments. Both counters stay at zero.

Read more →

containerd / kubernetes / open file limits

After upgrading a customer's Kubernetes cluster running on Ubuntu/Jammy, we ran into a snag. The vernemq instances wouldn't start completely, instead they gave us EMFILE errors: Too many open files. This came as a surprise. After all, we hadn't touched any limits. But, it turned out containerd v1.8 changed the LimitNOFILE setting from a very permissive infinity to the systemd default. The result? Processes inside Kubernetes would get a measly max 1024 file descriptors by default.

Read more →

linux / local root exploit / module vetting

Recently, we were greeted with the Copy Fail Linux kernel vulnerability. Mitigating this was a matter of denylisting a module. But, only eight days later, there was another exploit, also (ab)using AF_ALG and kernel module autoloading. I'm betting this is not the last, now that the kernel is scrutinized using AI models that keep getting more advanced. Luckily, we had our machine inventory up to date. So when CVE-2026-31431 ("Copy Fail") came along, deploying a mitigation was a matter of:

Read more →

Certifications

OSSO B.V.'s Information Security Management System is ISO/IEC 27001:2022 and NEN 7510-1:2017 certified

▸Read more about Security at OSSO
  • ISO/IEC 27001:2022 certified by DNV (#C621677)
    valid until 2026-11-27
  • NEN 7510-1:2017 + A1:2020 certified by DNV (#C621678)
    valid until 2026-11-27

Community

OSSO B.V. supports Open Source