Restricting docker zone to a single IP with firewall-cmd

Question

I'm trying to restrict my docker exposed ports to a sigle outside IP.

docker (active)
  target: ACCEPT
  icmp-block-inversion: no
  interfaces: br-27117bc1fd93 br-2905af95cf3a br-53c93737f17d br-69f2fcdc6f01 br-b4b3347f7b9c br-b932d5e56d55 br-dbc9429c2b1f docker0
  sources: 
  services: 
  ports: 
  protocols: 
  forward: no
  masquerade: no
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules: 

public (active)
  target: default
  icmp-block-inversion: no
  interfaces: enp3s0
  sources: 
  services: 
  ports: 
  protocols: 
  forward: no
  masquerade: no
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules: 

work (active)
  target: default
  icmp-block-inversion: no
  interfaces: 
  sources: XX.XXX.XXX.XXX
  services: cockpit dhcpv6-client http https portainerweb ssh
  ports: 
  protocols: 
  forward: no
  masquerade: no
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules: 

Currently the work zone is behaving as i want, (trafic is allowed to the services only for the source IP) and i want to have the docker zone behaving the same.

The problem is i can't add the same source IP to the docker zone.

Is there an obvious way i've missed, or do i need to start adding rich rules in order to have the desired behavior ?