diff --git a/ansible/roles/container_base/files/gai.conf b/ansible/roles/container_base/files/gai.conf
new file mode 100644
index 0000000000000000000000000000000000000000..6bfedbf5a1b19be83d10f4498c305541822a621c
--- /dev/null
+++ b/ansible/roles/container_base/files/gai.conf
@@ -0,0 +1,15 @@
+# New label table with separate label for 2001:db8::/32.
+# The RFC 3484 rules prefer the source and destination to have
+# the same label. So if we have a 2001:db8 source address and are
+# connecting to something on the public Internet which has both
+# v4 and v6 addresses, we will prefer to use v4 (where the source
+# and destination both have label "4") rather than v6.
+label ::1/128       0
+label ::/0          1
+label 2002::/16     2
+label ::/96         3
+label ::ffff:0:0/96 4
+label fec0::/10     5
+label fc00::/7      6
+label 2001:0::/32   7
+label 2001:db8::/32 8
diff --git a/ansible/roles/container_base/tasks/main.yml b/ansible/roles/container_base/tasks/main.yml
index e21d4fa4c4144c046192552801a281498bf6104a..8cbc7a564d2a1cbdb6b36aaaca353a9ff0ed49bb 100644
--- a/ansible/roles/container_base/tasks/main.yml
+++ b/ansible/roles/container_base/tasks/main.yml
@@ -13,3 +13,8 @@
     - pciutils
     - zip
     - unzip
+
+- name: update gai.conf
+  copy:
+    src: gai.conf
+    dest: /etc/gai.conf