diff --git a/core/includes/bootstrap.inc b/core/includes/bootstrap.inc
index 222ac0c..0c98674 100644
--- a/core/includes/bootstrap.inc
+++ b/core/includes/bootstrap.inc
@@ -1253,7 +1253,8 @@ function watchdog_exception($type, Exception $exception, $message = NULL, $varia
  * @see hook_watchdog()
  */
 function watchdog($type, $message, array $variables = NULL, $severity = WATCHDOG_NOTICE, $link = NULL) {
-  global $user, $base_root;
+  global $base_root;
+  $user = \Drupal::currentUser();
 
   static $in_error_state = FALSE;
 
@@ -1600,7 +1601,7 @@ function drupal_handle_request($test_only = FALSE) {
  * Returns the time zone of the current user.
  */
 function drupal_get_user_timezone() {
-  global $user;
+  $user = \Drupal::currentUser();
   $config = \Drupal::config('system.date');
 
   if ($user && $config->get('timezone.user.configurable') && $user->isAuthenticated() && $user->getTimezone()) {
@@ -1745,8 +1746,6 @@ function _drupal_bootstrap_kernel() {
  * Attempts to serve a page from the cache.
  */
 function _drupal_bootstrap_page_cache() {
-  global $user;
-
   require_once __DIR__ . '/database.inc';
   // Check for a cache mode force from settings.php.
   if (settings()->get('page_cache_without_database')) {
@@ -1762,7 +1761,7 @@ function _drupal_bootstrap_page_cache() {
   // to serve a cached page.
   if (!$request->cookies->has(session_name()) && $cache_enabled) {
     // Make sure there is a user object because its timestamp will be checked.
-    $user = drupal_anonymous_user();
+    \Drupal::getContainer()->set('current_user', drupal_anonymous_user());
     // Get the page from the cache.
     $cache = drupal_page_get_cache($request);
     // If there is a cached page, display it.
diff --git a/core/includes/session.inc b/core/includes/session.inc
index 839ead8..2de2adf 100644
--- a/core/includes/session.inc
+++ b/core/includes/session.inc
@@ -72,8 +72,6 @@ function _drupal_session_close() {
  *   The user's session, or an empty string if no session exists.
  */
 function _drupal_session_read($sid) {
-  global $user;
-
   // Write and Close handlers are called after destructing objects
   // since PHP 5.0.5.
   // Thus destructors can use sessions but session handler can't use objects.
@@ -86,6 +84,7 @@ function _drupal_session_read($sid) {
   $cookies = \Drupal::request()->cookies;
   if (!$cookies->has(session_name()) && !$cookies->has($insecure_session_name)) {
     $user = new UserSession();
+    \Drupal::getContainer()->set('current_user', $user);
     return '';
   }
 
@@ -136,7 +135,7 @@ function _drupal_session_read($sid) {
     'sid' => $sid,
     'value' => $user->session,
   );
-
+  \Drupal::getContainer()->set('current_user', $user);
   return $user->session;
 }
 
@@ -159,8 +158,6 @@ function _drupal_session_read($sid) {
  *   Always returns TRUE.
  */
 function _drupal_session_write($sid, $value) {
-  global $user;
-
   // The exception handler is not active at this point, so we need to do it
   // manually.
   try {
@@ -169,6 +166,8 @@ function _drupal_session_write($sid, $value) {
       return;
     }
 
+    $user = \Drupal::currentUser();
+
     // Check whether $_SESSION has been changed in this request.
     $last_read = &drupal_static('drupal_session_last_read');
     $is_changed = !isset($last_read) || $last_read['sid'] != $sid || $last_read['value'] !== $value;
@@ -241,8 +240,6 @@ function _drupal_session_write($sid, $value) {
  * Initializes the session handler, starting a session if needed.
  */
 function drupal_session_initialize() {
-  global $user;
-
   session_set_save_handler('_drupal_session_open', '_drupal_session_close', '_drupal_session_read', '_drupal_session_write', '_drupal_session_destroy', '_drupal_session_garbage_collection');
 
   $is_https = \Drupal::request()->isSecure();
@@ -263,7 +260,7 @@ function drupal_session_initialize() {
     // processes (like drupal_get_token()) needs to know the future
     // session ID in advance.
     $GLOBALS['lazy_session'] = TRUE;
-    $user = drupal_anonymous_user();
+    \Drupal::getContainer()->set('current_user', drupal_anonymous_user());
     // Less random sessions (which are much faster to generate) are used for
     // anonymous users than are generated in drupal_session_regenerate() when
     // a user becomes authenticated.
@@ -304,14 +301,12 @@ function drupal_session_start() {
  * If an anonymous user already have an empty session, destroy it.
  */
 function drupal_session_commit() {
-  global $user;
-
   if (!drupal_save_session()) {
     // We don't have anything to do if we are not allowed to save the session.
     return;
   }
 
-  if ($user->isAnonymous() && empty($_SESSION)) {
+  if (\Drupal::currentUser()->isAnonymous() && empty($_SESSION)) {
     // There is no session data to store, destroy the session if it was
     // previously started.
     if (drupal_session_started()) {
@@ -353,8 +348,6 @@ function drupal_session_started($set = NULL) {
  * @ingroup php_wrappers
  */
 function drupal_session_regenerate() {
-  global $user;
-
   // Nothing to do if we are not allowed to change the session.
   if (!drupal_save_session()) {
     return;
@@ -414,9 +407,9 @@ function drupal_session_regenerate() {
     // Start the session when it doesn't exist yet.
     // Preserve the logged in user, as it will be reset to anonymous
     // by _drupal_session_read.
-    $account = $user;
+    $account = \Drupal::currentUser();
     drupal_session_start();
-    $user = $account;
+    \Drupal::getContainer()->set('current_user', $account);
   }
   date_default_timezone_set(drupal_get_user_timezone());
 }
@@ -430,8 +423,6 @@ function drupal_session_regenerate() {
  *   Session ID.
  */
 function _drupal_session_destroy($sid) {
-  global $user;
-
   // Nothing to do if we are not allowed to change the session.
   if (!drupal_save_session()) {
     return;
@@ -446,7 +437,7 @@ function _drupal_session_destroy($sid) {
   // Reset $_SESSION and $user to prevent a new session from being started
   // in drupal_session_commit().
   $_SESSION = array();
-  $user = drupal_anonymous_user();
+  \Drupal::getContainer()->set('current_user', drupal_anonymous_user());
 
   // Unset the session cookies.
   _drupal_session_delete_cookie(session_name());
@@ -521,7 +512,7 @@ function _drupal_session_garbage_collection($lifetime) {
  *
  * This function allows the caller to temporarily disable writing of
  * session data, should the request end while performing potentially
- * dangerous operations, such as manipulating the global $user object.
+ * dangerous operations, such as manipulating the current user object.
  * See http://drupal.org/node/218104 for usage.
  *
  * @param $status
diff --git a/core/lib/Drupal/Core/Authentication/AuthenticationManager.php b/core/lib/Drupal/Core/Authentication/AuthenticationManager.php
index d3630c4..582bfa3 100644
--- a/core/lib/Drupal/Core/Authentication/AuthenticationManager.php
+++ b/core/lib/Drupal/Core/Authentication/AuthenticationManager.php
@@ -83,8 +83,6 @@ public function applies(Request $request) {
    * {@inheritdoc}
    */
   public function authenticate(Request $request) {
-    global $user;
-
     $account = NULL;
 
     // Iterate the availlable providers.
@@ -112,10 +110,7 @@ public function authenticate(Request $request) {
     //  for later access.
     $request->attributes->set('_authentication_provider', $this->triggeredProviderId);
 
-    // The global $user object is included for backward compatibility only and
-    // should be considered deprecated.
-    // @todo Remove this line once global $user is no longer used.
-    $user = $account;
+    \Drupal::getContainer()->set('current_user', $account);
 
     return $account;
   }
diff --git a/core/lib/Drupal/Core/Authentication/Provider/Cookie.php b/core/lib/Drupal/Core/Authentication/Provider/Cookie.php
index ae108dc..dee78ff 100644
--- a/core/lib/Drupal/Core/Authentication/Provider/Cookie.php
+++ b/core/lib/Drupal/Core/Authentication/Provider/Cookie.php
@@ -30,12 +30,10 @@ public function applies(Request $request) {
    * {@inheritdoc}
    */
   public function authenticate(Request $request) {
-    // Global $user is deprecated, but the session system is still based on it.
-    global $user;
     require_once DRUPAL_ROOT . '/' . settings()->get('session_inc', 'core/includes/session.inc');
     drupal_session_initialize();
     if (drupal_session_started()) {
-      return $user;
+      return \Drupal::currentUser();
     }
     return NULL;
   }
diff --git a/core/lib/Drupal/Core/Cron.php b/core/lib/Drupal/Core/Cron.php
index 1fe9727..36e9694 100644
--- a/core/lib/Drupal/Core/Cron.php
+++ b/core/lib/Drupal/Core/Cron.php
@@ -80,8 +80,8 @@ public function run() {
     // cron runs.
     // @todo This currently does not work, as it will not affect the current
     //   user being injected into services.
-    $original_user = $GLOBALS['user'];
-    $GLOBALS['user'] = new UserSession();
+    $original_user = \Drupal::currentUser();
+    \Drupal::getContainer()->set('current_user', new UserSession());
 
     // Try to allocate enough time to run all the hook_cron implementations.
     drupal_set_time_limit(240);
@@ -149,7 +149,7 @@ public function run() {
     // Restore the user.
     // @todo This currently does not work, as it will not affect the current
     //   user being injected into services.
-    $GLOBALS['user'] = $original_user;
+    \Drupal::getContainer()->set('current_user', $original_user);
     drupal_save_session($original_session_saving);
 
     return $return;
diff --git a/core/lib/Drupal/Core/Entity/EntityAccessController.php b/core/lib/Drupal/Core/Entity/EntityAccessController.php
index 835bb5a..b43c112 100644
--- a/core/lib/Drupal/Core/Entity/EntityAccessController.php
+++ b/core/lib/Drupal/Core/Entity/EntityAccessController.php
@@ -269,7 +269,7 @@ protected function checkCreateAccess(AccountInterface $account, array $context,
    */
   protected function prepareUser(AccountInterface $account = NULL) {
     if (!$account) {
-      $account = $GLOBALS['user'];
+      $account = \Drupal::currentUser();
     }
     return $account;
   }
diff --git a/core/lib/Drupal/Core/Form/FormBuilder.php b/core/lib/Drupal/Core/Form/FormBuilder.php
index 26a1c3d..ef7e21b 100644
--- a/core/lib/Drupal/Core/Form/FormBuilder.php
+++ b/core/lib/Drupal/Core/Form/FormBuilder.php
@@ -1771,8 +1771,7 @@ protected function currentUser() {
         $this->currentUser = \Drupal::currentUser();
       }
       else {
-        global $user;
-        $this->currentUser = $user;
+        $this->currentUser = \Drupal::currentUser();
       }
     }
     return $this->currentUser;
diff --git a/core/lib/Drupal/Core/Routing/Enhancer/AuthenticationEnhancer.php b/core/lib/Drupal/Core/Routing/Enhancer/AuthenticationEnhancer.php
index 6e577b9..58cb0be 100644
--- a/core/lib/Drupal/Core/Routing/Enhancer/AuthenticationEnhancer.php
+++ b/core/lib/Drupal/Core/Routing/Enhancer/AuthenticationEnhancer.php
@@ -55,11 +55,6 @@ public function enhance(array $defaults, Request $request) {
         $anonymous_user = drupal_anonymous_user();
 
         $this->container->set('current_user', $anonymous_user, 'request');
-
-        // The global $user object is included for backward compatibility only
-        // and should be considered deprecated.
-        // @todo Remove this line once global $user is no longer used.
-        $GLOBALS['user'] = $anonymous_user;
       }
     }
     return $defaults;
diff --git a/core/modules/basic_auth/lib/Drupal/basic_auth/Authentication/Provider/BasicAuth.php b/core/modules/basic_auth/lib/Drupal/basic_auth/Authentication/Provider/BasicAuth.php
index 282b891..96e422c 100644
--- a/core/modules/basic_auth/lib/Drupal/basic_auth/Authentication/Provider/BasicAuth.php
+++ b/core/modules/basic_auth/lib/Drupal/basic_auth/Authentication/Provider/BasicAuth.php
@@ -70,7 +70,7 @@ public function cleanup(Request $request) {}
    */
   public function handleException(GetResponseForExceptionEvent $event) {
     $exception = $event->getException();
-    if ($GLOBALS['user']->isAnonymous() && $exception instanceof AccessDeniedHttpException) {
+    if (\Drupal::currentUser()->isAnonymous() && $exception instanceof AccessDeniedHttpException) {
       if (!$this->applies($event->getRequest())) {
         $site_name = $this->configFactory->get('system.site')->get('name');
         global $base_url;
diff --git a/core/modules/history/lib/Drupal/history/Tests/Views/HistoryTimestampTest.php b/core/modules/history/lib/Drupal/history/Tests/Views/HistoryTimestampTest.php
index 182174c..c1de103 100644
--- a/core/modules/history/lib/Drupal/history/Tests/Views/HistoryTimestampTest.php
+++ b/core/modules/history/lib/Drupal/history/Tests/Views/HistoryTimestampTest.php
@@ -49,7 +49,7 @@ public function testHandlers() {
 
     $account = $this->drupalCreateUser();
     $this->drupalLogin($account);
-    $GLOBALS['user'] = $account;
+    \Drupal::getContainer()->set('current_user', $account);
 
     db_insert('history')
       ->fields(array(
diff --git a/core/modules/system/lib/Drupal/system/Tests/Common/FormatDateTest.php b/core/modules/system/lib/Drupal/system/Tests/Common/FormatDateTest.php
index c9ac3bd..0e78e15 100644
--- a/core/modules/system/lib/Drupal/system/Tests/Common/FormatDateTest.php
+++ b/core/modules/system/lib/Drupal/system/Tests/Common/FormatDateTest.php
@@ -94,8 +94,6 @@ function testAdminDefinedFormatDate() {
    * Tests the format_date() function.
    */
   function testFormatDate() {
-    global $user;
-
     $language_interface = \Drupal::languageManager()->getCurrentLanguage();
 
     $timestamp = strtotime('2007-03-26T00:00:00+00:00');
@@ -127,11 +125,13 @@ function testFormatDate() {
     $edit = array('preferred_langcode' => self::LANGCODE, 'mail' => $test_user->getEmail(), 'timezone' => 'America/Los_Angeles');
     $this->drupalPostForm('user/' . $test_user->id() . '/edit', $edit, t('Save'));
 
-    // Disable session saving as we are about to modify the global $user.
+    // Disable session saving as we are about to modify the current user.
     drupal_save_session(FALSE);
     // Save the original user and language and then replace it with the test user and language.
-    $real_user = $user;
+    $real_user = \Drupal::currentUser();
     $user = user_load($test_user->id(), TRUE);
+    \Drupal::getContainer()->set('current_user', $user);
+
     $real_language = $language_interface->id;
     $language_interface->id = $user->getPreferredLangcode();
     // Simulate a Drupal bootstrap with the logged-in user.
@@ -154,7 +154,7 @@ function testFormatDate() {
     $this->assertIdentical(format_date($timestamp, 'html_year'), '2007', 'Test html_year date format.');
 
     // Restore the original user and language, and enable session saving.
-    $user = $real_user;
+    \Drupal::getContainer()->set('current_user', $real_user);
     $language_interface->id = $real_language;
     // Restore default time zone.
     date_default_timezone_set(drupal_get_user_timezone());
diff --git a/core/modules/system/lib/Drupal/system/Tests/Datetime/DrupalDateTimeTest.php b/core/modules/system/lib/Drupal/system/Tests/Datetime/DrupalDateTimeTest.php
index 3707bf8..4bf3959 100644
--- a/core/modules/system/lib/Drupal/system/Tests/Datetime/DrupalDateTimeTest.php
+++ b/core/modules/system/lib/Drupal/system/Tests/Datetime/DrupalDateTimeTest.php
@@ -57,8 +57,6 @@ public function testSystemTimezone() {
    * stated timezones.
    */
   public function testDateTimezone() {
-    global $user;
-
     $date_string = '2007-01-31 21:00:00';
 
     // Make sure no site timezone has been set.
@@ -99,11 +97,12 @@ public function testDateTimezone() {
     $edit = array('mail' => $test_user->getEmail(), 'timezone' => 'Asia/Manila');
     $this->drupalPostForm('user/' . $test_user->id() . '/edit', $edit, t('Save'));
 
-    // Disable session saving as we are about to modify the global $user.
+    // Disable session saving as we are about to modify the current user.
     drupal_save_session(FALSE);
     // Save the original user and then replace it with the test user.
     $real_user = $user;
     $user = user_load($test_user->id(), TRUE);
+    \Drupal::getContainer()->set('current_user', $user);
 
     // Simulate a Drupal bootstrap with the logged-in user.
     date_default_timezone_set(drupal_get_user_timezone());
@@ -116,7 +115,7 @@ public function testDateTimezone() {
     $this->assertTrue($timezone == 'Asia/Manila', 'DrupalDateTime uses the user timezone, if configurable timezones are used and it is set.');
 
     // Restore the original user, and enable session saving.
-    $user = $real_user;
+    \Drupal::getContainer()->set('current_user', $real_user);
     // Restore default time zone.
     date_default_timezone_set(drupal_get_user_timezone());
     drupal_save_session(TRUE);
diff --git a/core/modules/system/lib/Drupal/system/Tests/Entity/EntityAccessTest.php b/core/modules/system/lib/Drupal/system/Tests/Entity/EntityAccessTest.php
index ee64237..f80fa29 100644
--- a/core/modules/system/lib/Drupal/system/Tests/Entity/EntityAccessTest.php
+++ b/core/modules/system/lib/Drupal/system/Tests/Entity/EntityAccessTest.php
@@ -49,8 +49,9 @@ function assertEntityAccess($ops, AccessibleInterface $object, AccountInterface
    */
   function testEntityAccess() {
     // Set up a non-admin user that is allowed to view test entities.
-    global $user;
     $user = $this->createUser(array('uid' => 2), array('view test entity'));
+    \Drupal::getContainer()->set('current_user', $user);
+
     $entity = entity_create('entity_test', array(
       'name' => 'test',
     ));
@@ -78,8 +79,8 @@ function testEntityAccess() {
    */
   function testEntityAccessDefaultController() {
     // The implementation requires that the global user id can be loaded.
-    global $user;
     $user = $this->createUser(array('uid' => 2));
+    \Drupal::getContainer()->set('current_user', $user);
 
     // Check that the default access controller is used for entities that don't
     // have a specific access controller defined.
@@ -101,8 +102,8 @@ function testEntityAccessDefaultController() {
   function testEntityTranslationAccess() {
 
     // Set up a non-admin user that is allowed to view test entity translations.
-    global $user;
     $user = $this->createUser(array('uid' => 2), array('view test entity translations'));
+    \Drupal::getContainer()->set('current_user', $user);
 
     // Create two test languages.
     foreach (array('foo', 'bar') as $langcode) {
diff --git a/core/modules/user/lib/Drupal/user/Tests/Views/ArgumentDefaultTest.php b/core/modules/user/lib/Drupal/user/Tests/Views/ArgumentDefaultTest.php
index 654d1d7..655ae61 100644
--- a/core/modules/user/lib/Drupal/user/Tests/Views/ArgumentDefaultTest.php
+++ b/core/modules/user/lib/Drupal/user/Tests/Views/ArgumentDefaultTest.php
@@ -33,17 +33,17 @@ public function test_plugin_argument_default_current_user() {
 
     // Switch the user, we have to check the global user too, because drupalLogin is only for the simpletest browser.
     $this->drupalLogin($account);
-    global $user;
-    $admin = $user;
+
+    $admin = \Drupal::currentUser();
     drupal_save_session(FALSE);
-    $user = $account;
+    \Drupal::getContainer()->set('current_user', $account);
 
     $view = views_get_view('test_plugin_argument_default_current_user');
     $view->initHandlers();
 
     $this->assertEqual($view->argument['null']->getDefaultArgument(), $account->id(), 'Uid of the current user is used.');
     // Switch back.
-    $user = $admin;
+    \Drupal::getContainer()->set('current_user', $admin);
     drupal_save_session(TRUE);
   }
 
diff --git a/core/modules/user/user.module b/core/modules/user/user.module
index cfdc66c..58a8e8f 100644
--- a/core/modules/user/user.module
+++ b/core/modules/user/user.module
@@ -269,8 +269,8 @@ function user_load_multiple(array $uids = NULL, $reset = FALSE) {
 /**
  * Loads a user object.
  *
- * Drupal has a global $user object, which represents the currently-logged-in
- * user. So to avoid confusion and to avoid clobbering the global $user object,
+ * Drupal has a currend user object, which represents the currently-logged-in
+ * user. So to avoid confusion and to avoid clobbering the current user object,
  * it is a good idea to assign the result of this function to a different local
  * variable, generally $account. If you actually do want to act as the user you
  * are loading, it is essential to call drupal_save_session(FALSE); first.
@@ -438,12 +438,10 @@ function _user_role_permissions_update($roles) {
  *   Use \Drupal\Core\Session\AccountInterface::hasPermission().
  */
 function user_access($string, AccountInterface $account = NULL) {
-  global $user;
-
   if (!isset($account)) {
     // In the installer request session is not set, so we have to fall back
-    // to the global $user. In all other cases the session key is preferred.
-    $account = \Drupal::currentUser() ?: $user;
+    // to the current user. In all other cases the session key is preferred.
+    $account = \Drupal::currentUser();
   }
 
   return $account->hasPermission($string);
@@ -825,7 +823,7 @@ function user_authenticate($name, $password) {
  * session, saves the login timestamp, calls hook_user_login(), and generates a
  * new session.
  *
- * The global $user object is replaced with the passed in account.
+ * The current user object is replaced with the passed in account.
  *
  * @param \Drupal\user\UserInterface $account
  *   The account to log in.
@@ -833,8 +831,7 @@ function user_authenticate($name, $password) {
  * @see hook_user_login()
  */
 function user_login_finalize(UserInterface $account) {
-  global $user;
-  $user = $account;
+  \Drupal::getContainer()->set('current_user', $account);
   watchdog('user', 'Session opened for %name.', array('%name' => $account->getUsername()));
   // Update the user table timestamp noting user has logged in.
   // This is also used to invalidate one-time login links.
@@ -1016,8 +1013,6 @@ function user_cancel($edit, $uid, $method) {
  * @see user_cancel()
  */
 function _user_cancel($edit, $account, $method) {
-  global $user;
-
   switch ($method) {
     case 'user_cancel_block':
     case 'user_cancel_block_unpublish':
@@ -1048,8 +1043,8 @@ function _user_cancel($edit, $account, $method) {
   // their session though, as we might have information in it, and we can't
   // regenerate it because batch API uses the session ID, we will regenerate it
   // in _user_cancel_session_regenerate().
-  if ($account->id() == $user->id()) {
-    $user = drupal_anonymous_user();
+  if ($account->id() == \Drupal::currentUser()->id()) {
+    \Drupal::getContainer()->set('current_user', drupal_anonymous_user());
   }
 
   // Clear the cache for anonymous users.
diff --git a/core/modules/user/user.pages.inc b/core/modules/user/user.pages.inc
index 22d221a..1384e6f 100644
--- a/core/modules/user/user.pages.inc
+++ b/core/modules/user/user.pages.inc
@@ -18,7 +18,7 @@
  *   Use \Drupal\user\Form\UserForm::resetPass().
  */
 function user_pass_reset($form, &$form_state, $uid, $timestamp, $hashed_pass, $action = NULL) {
-  global $user;
+  $user = \Drupal::currentUser();
 
   // When processing the one-time login link, we have to make sure that a user
   // isn't already logged in.
diff --git a/core/scripts/generate-d7-content.sh b/core/scripts/generate-d7-content.sh
index 30c61a2..b7d7101 100644
--- a/core/scripts/generate-d7-content.sh
+++ b/core/scripts/generate-d7-content.sh
@@ -257,11 +257,11 @@
   // Add some votes
   $node = node_load($node->nid);
   $choices = array_keys($node->choice);
-  $original_user = $GLOBALS['user'];
+  $original_user = \Drupal::currentUser();
   for ($v = 0; $v < ($i % 4); $v++) {
     drupal_static_reset('ip_address');
     $_SERVER['REMOTE_ADDR'] = "127.0.$v.1";
-    $GLOBALS['user'] = drupal_anonymous_user();// We should have already allowed anon to vote.
+    \Drupal::getContainer()->set('current_user', drupal_anonymous_user()); // We should have already allowed anon to vote.
     $c = $v % $nbchoices;
     $form_state = array();
     $form_state['values']['choice'] = $choices[$c];