diff --git a/core/modules/user/user.module b/core/modules/user/user.module
index dcdc07e..5c20324 100644
--- a/core/modules/user/user.module
+++ b/core/modules/user/user.module
@@ -266,8 +266,8 @@ function user_load_multiple(array $uids = NULL, $reset = FALSE) {
 /**
  * Loads a user object.
  *
- * Drupal has a global $user object, which represents the currently-logged-in
- * user. So to avoid confusion and to avoid clobbering the global $user object,
+ * Drupal has a currend user object, which represents the currently-logged-in
+ * user. So to avoid confusion and to avoid clobbering the current user object,
  * it is a good idea to assign the result of this function to a different local
  * variable, generally $account. If you actually do want to act as the user you
  * are loading, it is essential to call drupal_save_session(FALSE); first.
@@ -431,12 +431,10 @@ function _user_role_permissions_update($roles) {
  *   \Drupal\Core\Session\AccountInterface::hasPermission()
  */
 function user_access($string, AccountInterface $account = NULL) {
-  global $user;
-
   if (!isset($account)) {
     // In the installer request session is not set, so we have to fall back
-    // to the global $user. In all other cases the session key is preferred.
-    $account = \Drupal::currentUser() ?: $user;
+    // to the current user. In all other cases the session key is preferred.
+    $account = \Drupal::currentUser();
   }

   return $account->hasPermission($string);
@@ -961,7 +959,7 @@ function user_authenticate($name, $password) {
  * session, saves the login timestamp, calls hook_user_login(), and generates a
  * new session.
  *
- * The global $user object is replaced with the passed in account.
+ * The current user object is replaced with the passed in account.
  *
  * @param \Drupal\user\UserInterface $account
  *   The account to log in.
@@ -969,8 +967,7 @@ function user_authenticate($name, $password) {
  * @see hook_user_login()
  */
 function user_login_finalize(UserInterface $account) {
-  global $user;
-  $user = $account;
+  \Drupal::getContainer()->set('current_user', $account);
   watchdog('user', 'Session opened for %name.', array('%name' => $user->getUsername()));
   // Update the user table timestamp noting user has logged in.
   // This is also used to invalidate one-time login links.
@@ -1153,8 +1150,6 @@ function user_cancel($edit, $uid, $method) {
  * @see user_cancel()
  */
 function _user_cancel($edit, $account, $method) {
-  global $user;
-
   switch ($method) {
     case 'user_cancel_block':
     case 'user_cancel_block_unpublish':
@@ -1185,8 +1180,8 @@ function _user_cancel($edit, $account, $method) {
   // their session though, as we might have information in it, and we can't
   // regenerate it because batch API uses the session ID, we will regenerate it
   // in _user_cancel_session_regenerate().
-  if ($account->id() == $user->id()) {
-    $user = drupal_anonymous_user();
+  if ($account->id() == \Drupal::currentUser()->id()) {
+    \Drupal::getContainer()->set('current_user', drupal_anonymous_user());
   }

   // Clear the cache for anonymous users.