diff -u b/core/includes/bootstrap.inc b/core/includes/bootstrap.inc
--- b/core/includes/bootstrap.inc
+++ b/core/includes/bootstrap.inc
@@ -2289,9 +2289,9 @@
  * Initialize the kernel / service container.
  */
 function _drupal_bootstrap_kernel() {
-  // Normally, index.php puts a kernel in the global namespace. Other scripts
-  // might not.
-  if (empty($GLOBALS['kernel'])) {
+  // Normally, index.php puts a container in drupal_container() by creating a
+  // kernel. If there is no container yet, create one.
+  if (!drupal_container()) {
     $kernel = new DrupalKernel('prod', FALSE, drupal_classloader());
     $kernel->boot();
   }
@@ -2441,29 +2441,20 @@
  * @see Drupal\Core\DrupalKernel
  *
  * @param Symfony\Component\DependencyInjection\Container $new_container
- *   A new container instance to replace the current.
- * @param bool $rebuild
- *   (optional) Internal use only. Whether to enforce a rebuild of the container.
- *   Used by the testing framework to inject a fresh container for unit tests.
+ *   (optional) A new container instance to replace the current.
  *
- * @return Symfony\Component\DependencyInjection\Container
+ * @return Symfony\Component\DependencyInjection\Container|bool
  *   The instance of the Container used to set up and maintain object
- *   instances.
+ *   instances or FALSE if none exist yet.
  */
-function drupal_container(Container $new_container = NULL, $rebuild = FALSE) {
+function drupal_container(Container $new_container = NULL) {
   // We do not use drupal_static() here because we do not have a mechanism by
   // which to reinitialize the stored objects, so a drupal_static_reset() call
   // would leave Drupal in a nonfunctional state.
-  static $container = NULL;
-  if ($rebuild) {
-    $container = NULL;
-  }
+  static $container = FALSE;
   if (isset($new_container)) {
     $container = $new_container;
   }
-  if (!isset($container)) {
-    $container = new ContainerBuilder();
-  }
   return $container;
 }
 
diff -u b/core/lib/Drupal/Component/PhpStorage/FileStorage.php b/core/lib/Drupal/Component/PhpStorage/FileStorage.php
--- b/core/lib/Drupal/Component/PhpStorage/FileStorage.php
+++ b/core/lib/Drupal/Component/PhpStorage/FileStorage.php
@@ -83,6 +83,7 @@
    * Implements Drupal\Component\PhpStorage\PhpStorageInterface::deleteAll().
    */
   function deleteAll() {
+    // @todo remove this to properly decouple this class from Drupal.
     if (!function_exists('file_unmanaged_delete_recursive')) {
       include_once DRUPAL_ROOT . '/core/includes/file.inc';
     }
diff -u b/core/lib/Drupal/Component/PhpStorage/MTimeProtectedFastFileStorage.php b/core/lib/Drupal/Component/PhpStorage/MTimeProtectedFastFileStorage.php
--- b/core/lib/Drupal/Component/PhpStorage/MTimeProtectedFastFileStorage.php
+++ b/core/lib/Drupal/Component/PhpStorage/MTimeProtectedFastFileStorage.php
@@ -40,6 +40,8 @@
  */
 class MTimeProtectedFastFileStorage extends FileStorage {
 
+  const HTACCESS="SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006\nDeny from all\nOptions None\nOptions +FollowSymLinks";
+
   /**
    * The secret used in the HMAC.
    *
@@ -144,10 +146,10 @@
       mkdir($this->directory, 0700, TRUE);
     }
     chmod($this->directory, 0700);
-    if (!function_exists('file_unmanaged_delete_recursive')) {
-      include_once DRUPAL_ROOT . '/core/includes/file.inc';
+    $htaccess_path =  $this->directory . '/.htaccess';
+    if (!file_exists($htaccess_path) && file_put_contents($htaccess_path, self::HTACCESS)) {
+      @chmod($htaccess_path, 0444);
     }
-    file_save_htaccess($this->directory);
   }
 
   /**
diff -u b/core/modules/simpletest/lib/Drupal/simpletest/TestBase.php b/core/modules/simpletest/lib/Drupal/simpletest/TestBase.php
--- b/core/modules/simpletest/lib/Drupal/simpletest/TestBase.php
+++ b/core/modules/simpletest/lib/Drupal/simpletest/TestBase.php
@@ -8,6 +8,7 @@
 namespace Drupal\simpletest;
 
 use Drupal\Core\Database\Database;
+use Drupal\Core\DependencyInjection\ContainerBuilder;
 use Drupal\Core\Database\ConnectionNotDefinedException;
 use Drupal\Core\DrupalKernel;
 use ReflectionMethod;
@@ -873,7 +874,8 @@
     }
 
     // Reset and create a new service container.
-    $this->container = drupal_container(NULL, TRUE);
+    $this->container = new ContainerBuilder();
+    drupal_container($this->container);
 
     // Unset globals.
     unset($GLOBALS['theme_key']);
@@ -906,9 +908,6 @@
    *   enabled modules to be immediately available in the same request.
    */
   protected function rebuildContainer() {
-    // DrupalKernel expects to merge a fresh bootstrap container, not remerge
-    // what is left over from a prior container build.
-    drupal_container(NULL, TRUE);
     // Create a new DrupalKernel for testing purposes, now that all required
     // modules have been enabled. This also stores a new dependency injection
     // container in drupal_container(). Drupal\simpletest\TestBase::tearDown()
@@ -966,7 +965,7 @@
     // In case a fatal error occurred that was not in the test process read the
     // log to pick up any fatal errors.
     simpletest_log_read($this->testId, $this->databasePrefix, get_class($this), TRUE);
-    if (drupal_container()->has('keyvalue')) {
+    if (($container = drupal_container()) && $container->has('keyvalue')) {
       $captured_emails = state()->get('system.test_email_collector') ?: array();
       $emailCount = count($captured_emails);
       if ($emailCount) {
only in patch2:
unchanged:
--- a/core/includes/file.inc
+++ b/core/includes/file.inc
@@ -5,10 +5,12 @@
  * API for handling file uploads and server file management.
  */
 
+use Drupal\Core\StreamWrapper\LocalStream;
+use Drupal\Component\PhpStorage\MTimeProtectedFastFileStorage;
 use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
 use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
 use Symfony\Component\HttpFoundation\StreamedResponse;
-use Drupal\Core\StreamWrapper\LocalStream;
+
 /**
  * Stream wrapper bit flags that are the basis for composite types.
  *
@@ -558,7 +560,7 @@ function file_save_htaccess($directory, $private = TRUE) {
 
   if ($private) {
     // Private .htaccess file.
-    $htaccess_lines = "SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006\nDeny from all\nOptions None\nOptions +FollowSymLinks";
+    $htaccess_lines = MTimeProtectedFastFileStorage::HTACCESS;
   }
   else {
     // Public .htaccess file.
only in patch2:
unchanged:
--- a/core/modules/system/lib/Drupal/system/Tests/DrupalKernel/DrupalKernelTest.php
+++ b/core/modules/system/lib/Drupal/system/Tests/DrupalKernel/DrupalKernelTest.php
@@ -30,11 +30,6 @@ public static function getInfo() {
    * Tests DIC compilation.
    */
   function testCompileDIC() {
-    // Because we'll be instantiating a new kernel during this test, the
-    // container stored in drupal_container() will be updated as a side effect.
-    // We need to be able to restore it to the correct one at the end of this
-    // test.
-    $original_container = drupal_container();
     $classloader = drupal_classloader();
     global $conf;
     $conf['php_storage']['service_container']= array(
@@ -63,9 +58,6 @@ function testCompileDIC() {
       !$refClass->isSubclassOf('Symfony\Component\DependencyInjection\ContainerBuilder');
     $this->assertTrue($is_compiled_container);
 
-    // Reset the container.
-    drupal_container(NULL, TRUE);
-
     // Now use the read-only storage implementation, simulating a "production"
     // environment.
     $conf['php_storage']['service_container']['class'] = 'Drupal\Component\PhpStorage\FileReadOnlyStorage';
@@ -89,9 +81,6 @@ function testCompileDIC() {
     // modules.
     $this->assertFalse($container->has('bundle_test_class'));
 
-    // Reset the container.
-    drupal_container(NULL, TRUE);
-
     // Add another module so that we can test that the new module's bundle is
     // registered to the new container.
     $module_enabled['bundle_test'] = 'bundle_test';
@@ -113,8 +102,5 @@ function testCompileDIC() {
     $classloader = $container->get('class_loader');
     $refClass = new ReflectionClass($classloader);
     $this->assertTrue($refClass->hasMethod('getNamespaces'), 'Container has a classloader');
-
-    // Restore the original container.
-    drupal_container($original_container);
   }
 }