note on image builds & no public IP

Author: Larry Franks

articles/machine-learning/how-to-secure-training-vnet.md

@@ -107,7 +107,7 @@ In this article you learn how to secure the following training compute resources
 
 * If you create a compute instance and plan to use the no public IP address configuration, your Azure Machine Learning workspace's managed identity must be assigned the __Reader__ role for the virtual network that contains the workspace. For more information on assigning roles, see [Steps to assign an Azure role](/azure/role-based-access-control/role-assignments-steps).
 
-* If you create a compute cluster with the no public IP address configuration, you can't use it as the [image build cluster](how-to-secure-workspace-vnet.md#configure-image-builds) for your workspace.
+* If you have configured Azure Container Registry for your workspace behind the virtual network, you must use a compute cluster to build Docker images. You can't use a compute cluster with the no public IP address configuration. For more information, see [Enable Azure Container Registry](how-to-secure-workspace-vnet.md#enable-azure-container-registry-acr).
 
 * If the Azure Storage Accounts for the workspace are also in the virtual network, use the following guidance on subnet limitations: