ComfyUI local image generation: install, model folders and custom node safety

ComfyUI local image generation means running diffusion models such as Stable Diffusion 1.5, SDXL or Flux on your own GPU through a node graph in the browser. Install Comfy Desktop, the Windows portable build or a manual Python setup, put a checkpoint in ComfyUI/models/checkpoints, and run the default text-to-image workflow. Custom nodes are Python code from third parties, so treat each one as software you are choosing to run.

What ComfyUI is

ComfyUI (opens in a new tab) is an open-source engine for generative models with a visual node graph interface. Each node does one job, such as loading a model, encoding a prompt or sampling, and you wire them together into a workflow. The core repository is GPL-3.0 and is maintained by Comfy Org. The latest release at the time of writing is v0.38.0, published on 29 September 2026.

The README lists native support for image models including Stable Diffusion 1.5, SDXL, SD3.5, Flux.1, Flux.2, Qwen Image and HiDream, plus video, audio and 3D models. It also says the core runs fully offline and downloads nothing unless you ask it to. The --offline flag disables the optional paid API nodes as well.

Two execution details from the README matter in daily use. ComfyUI only runs the parts of a graph that changed since the last run. A generated PNG dragged back onto the page restores the full workflow, seeds included.

ComfyUI install options compared

ComfyUI has three local install paths. The table compares them using the official docs and README.

Comfy Desktop

Comfy Desktop is a launcher that installs and manages one or more ComfyUI instances, each with its own version, custom nodes and settings. The docs list at least 4.85 GB of disk per install and 8 GB of RAM, with 16 GB recommended. The ComfyUI README calls the desktop app the easiest way for new users to start.

Windows portable build

The portable build is a 7z archive with its own Python environment in python_embeded. Extract it and double-click run_nvidia_gpu.bat, run_amd_gpu.bat or run_intel_gpu.bat, or run_cpu.bat for CPU only. The README says the main NVIDIA build supports 20 series cards and newer. A separate build with CUDA 12.6 and Python 3.12 is for 10 series and older cards, and the README warns against using it on newer GPUs.

Manual install

A manual install gives you full control. The README steps are: clone the repository, install PyTorch for your hardware, then install the requirements.

git clone https://github.com/Comfy-Org/ComfyUI.git
cd ComfyUI
pip install torch torchvision torchaudio --extra-index-url https://download.pytorch.org/whl/cu130
pip install -r requirements.txt
python main.py

The PyTorch line above is the NVIDIA command. The README lists different commands for AMD (ROCm on Linux and Windows), Intel Arc (XPU) and Apple Silicon. It also says PyTorch 2.7 is the minimum, that newer versions are strongly recommended, and that NVIDIA 20 series and newer need a cu130 or later build. The comfy-cli tool is another route: pip install comfy-cli followed by comfy install.

By default ComfyUI listens on 127.0.0.1, port 8188, according to the startup flags reference.

Where checkpoints and other model files go

ComfyUI ships without model weights. The models documentation (opens in a new tab) says you download them yourself, place each file in the matching subfolder of ComfyUI/models/, then select it in a loader node (most loader nodes have names starting with "Load").

The common subfolders in the repository are:

• checkpoints for full checkpoints such as SD 1.5 or SDXL
• diffusion_models for standalone diffusion models loaded separately from their VAE and text encoders
• text_encoders for text encoders
• vae for VAEs
• loras for LoRA files
• controlnet for ControlNet models
• upscale_models for upscalers
• embeddings for textual inversion embeddings

The README notes that larger models often come as several files, so follow each model's instructions on which subfolder each file needs. If you add files while ComfyUI is running, restart or refresh so the loader lists update. There is no uninstall button for models; you delete the file.

To share one model library between several installs, or with another UI, copy extra_model_paths.yaml.example in the ComfyUI root to extra_model_paths.yaml and set a base_path plus a folder per model type. Comfy Desktop keeps the equivalent setting in its Storage tab and in extra_models_config.yaml.

Run a first text-to-image workflow

The official text-to-image tutorial uses Stable Diffusion 1.5, which the docs describe as a model of about 4 GB, trained at 512×512, that runs on consumer GPUs with around 6 GB of VRAM.

Step 1: download the checkpoint

Download v1-5-pruned-emaonly-fp16.safetensors (opens in a new tab) from Comfy-Org's archive on Hugging Face and put it in ComfyUI/models/checkpoints.

Step 2: load the workflow

The tutorial provides a PNG with the workflow embedded in its metadata. Drag it onto the canvas, or open it from Workflows, then Open.

Step 3: check the nodes and queue the job

The graph has six main nodes:

1. Load Checkpoint loads the model, its CLIP text encoder and its VAE. Make sure it shows your file and not null.
2. Two CLIP Text Encode nodes hold the positive and negative prompts.
3. Empty Latent Image sets the size of the blank latent the sampler starts from.
4. KSampler runs the denoising, controlled by seed, steps, cfg and denoise.
5. VAE Decode turns the latent result into pixels.
6. Save Image shows the output and saves it.

Press Ctrl + Enter to queue the job. Each run uses a new random seed unless you fix it in KSampler. For emphasis in a prompt, the README documents the (phrase:1.2) syntax, with 1.1 as the default weight for plain brackets.

GPU and memory notes from the docs

The system requirements page (opens in a new tab) lists support for NVIDIA GPUs, AMD GPUs on Linux (ROCm 7.2) and Windows (ROCm 10.0, RDNA 2 through RDNA 4), Intel Arc, Apple Silicon M1 to M4, and several NPUs. CPU-only use works with the --cpu flag, which the docs call slow. On a Mac, ComfyUI uses PyTorch's MPS backend; it does not use MLX.

The README claims ComfyUI can run large open models on as little as 4 GB of VRAM and 8 GB of system RAM by streaming weights. That figure comes from the project, and actual speed depends on the model.

Memory handling is automatic by default. The startup flags reference says async weight offloading is on for NVIDIA and AMD GPUs, and dynamic VRAM is enabled where supported. These flags override it and cannot be combined:

The docs also point out that a single generative model is often many gigabytes, so plan disk space before downloading a model family. ComfyUI has no official Docker image; the docs say community images on Docker Hub are unofficial and unsupported.

Custom nodes and the risk of running third-party code

A custom node is a folder of Python (and often JavaScript) in ComfyUI/custom_nodes, usually with its own requirements.txt. At startup ComfyUI imports each custom node through its __init__.py, so the pack's code runs inside the ComfyUI process with access to everything ComfyUI can reach.

The custom node installation guide (opens in a new tab) warns that malicious plugins can exploit custom nodes. It tells you to install only from trusted, widely used authors and to avoid obscure or unverified packs.

ComfyUI-Manager is the recommended way to install them. It is built into current ComfyUI. On portable and manual installs you enable it yourself:

pip install -r manager_requirements.txt
python main.py --enable-manager

The Manager has a security_level setting in its config.ini, documented on the Manager configuration page (opens in a new tab). Installing by git URL, running pip installs and installing nodes outside the default channel count as high-risk features.

The strong level blocks high and middle risk features, normal blocks high-risk ones, and weak allows everything. The normal- level blocks high-risk features only when ComfyUI listens on an address other than 127.x. Comfy Desktop exposes the same idea as Strict, Standard (recommended), Relaxed and Permissive.

Network exposure raises the stakes. The --listen flag with no value binds to all interfaces, so other machines on your network can reach the UI, including whatever Manager install features the security level allows. The Manager docs say stricter security levels matter most in that case.

Before you install a custom node, run through this checklist:

• ☐To do: The pack is listed in the Manager's registry, or you have read its repository yourself
• ☐To do: The author and pack are widely used, and the repository shows recent maintenance
• ☐To do: You have read its requirements.txt and know what it will pip install
• ☐To do: Dependencies go into ComfyUI's environment (python_embeded on portable), never your system Python
• ☐To do: The Manager security level is normal or stricter, and strong if you use --listen
• ☐To do: ComfyUI is not exposed beyond 127.0.0.1 unless you need it to be
• ☐To do: You know how to start without custom nodes: python main.py --disable-all-custom-nodes

That last flag is also the first step in the official troubleshooting guide when a node breaks your install. The --whitelist-custom-nodes flag lets you keep specific folders, such as ComfyUI-Manager, loaded while the rest stay off.