In some cases, there is no better way than injecting the container itself and use it as a service locator.
The issue then is that one can access any public service, thus it is almost impossible to track service dependencies for such code.

I'd like to propose a first class service locator concept, with mandatory and explicit dependencies declaration. Such code would have first to explicitly declare the list of services they need to get them, through a dedicated container (service locator really) that would have access to them and only them.

We could then maybe deprecate injecting the main container directly, and replace that by the possibility for such a service locator to return the "service_container" when required (though that would be a discouraged practice, but could be required for e.g container inspecting logics).