They aren't: -Werror is doing exactly what it is supposed to, keeping a tacit assumption from subtly causing bugs. sysctl is necessary because there is no rando

They aren't: -Werror is doing exactly what it is supposed to, keeping a tacit assumption from subtly causing bugs. sysctl is necessary because there is no randomness system call, and in chroots /dev/random is not available.