Illuminate\Foundation\Application extends the service container (The Service Container), and app() and every facade reach the same instance. Its constructor only records the base path and registers four base providers (events, logging, context, routing), so the tracer could listen to events early. The real work is the kernel's $bootstrappers array, the six classes in the figure above: bootstrapWith() runs them in order and fires bootstrapping: <class> before each. The console kernel adds SetRequestForConsole so url() works in Artisan.
A route returning count(app()->getLoadedProviders()) and count(app()->getDeferredServices()) reported 24 loaded providers and 161 deferred services, including mailer, queue, cache and hash: a deferred provider loads only when one of its services is resolved. PHP-FPM rebuilds all this per request; Octane 4,043 (Octane) bootstraps once per worker.