Set the LIVEBOOK_IDENTITY_PROVIDER environment variable and every route of your instance is protected.
docker run -p 8080:8080 -p 8081:8081 --pull always \
-e LIVEBOOK_PASSWORD="securesecret" \
-e LIVEBOOK_IDENTITY_PROVIDER="tailscale:/var/run/tailscale/tailscaled.sock" \
ghcr.io/livebook-dev/livebook