Future routers will not only forward data packets but also provide value-added services, such as security, accounting, caching, and resource management. These services ran be implemented as general programs, to be invoked by traversing packets embedding router program calls. Software-programmable routers pose new challenges in the design of router operating systems (OS). First, router programs will require access to diverse system resources. The resource demands of a large community of heterogeneous resource consumers must either be coordinated to enable cooperation or arbitrated to resolve competition. Second, it is beneficial to concurrently support multiple virtual machines, each with a guaranteed share of physical resources. This allows services to be customized and to seamlessly evolve. We present the design and implementation of a next generation router OS that can meet the above challenges. We define an orthogonal kernel abstraction of resource allocation, which can schedule various time-shared and space-shared resources with quality of service (QoS) differentiation and guarantees. A scalable and flexible packet classifier enables dynamic resource binding and per-flow processing of received packets. We have prototyped our system on a network of UltraSPARC and Pentium II computers. Currently, QoS-aware schedulers for CPU time, forwarding bandwidth, memory-store capacity, and capacity for secondary data stores have been integrated. We present experimental results on various aspects of resource management in our system.