I have a build variable which is a secret, your system does not support build secret so I am forced to use variables, so i add it and seal it, seems good...

No, because when dockerfile is being executed, it prints out every command including the secret!

Why does seal not prevent the value from being printed? seems like an oversight to me!