Works for me in 7.0(3)I2(3). I would open a TAC case to deep dive.//NXOS: version 7.0(3)I2(3)ip access-list CC-traffic  10 permit ip 10.1.1.1/32 any version 7.0(3)I2(3)class-map type qos match-any CC-servers  match access-group name CC-trafficpolicy-...

Sorry I missed following up on this thread. I tested on a later release 7.0(3)I4(7) and this seems to work. I generally avoid suggesting an upgrade as a solution but sometimes I have found that customer are more open to that idea if it can solve issu...

With the N3k operating in the N9k mode you have bit more flexibility to configure CoPP.  The TCAM carving is also different. There is also differences in the QoS implementation. There may also be a license piece that may come into play when using n9k...

I am not an expert on the use case aspect of docker but I have found that ciscolive.com has a number of on demand sessions on this topic that may provide you the answer you are looking for.   Thanks, Raj  

Hi Adam, I don't think you can do the “system switch-mode n9k” on the 3032Q. https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus3000/sw/fundamentals/7x/b_Cisco_Nexus_3000_Series_NX-OS_Fundamentals_Configuration_Guide_7x/b_Cisco_Nexus_3000...