diff --git a/Dockerfile b/Dockerfile
index 3fe30de..3ee5c36 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,5 @@
 # Tensors + ComfyUI for RTX 5090 / CUDA 12.8
+# tensors API exposed, ComfyUI internal only
 FROM madiator2011/better-comfyui:slim-5090
 
 WORKDIR /workspace
@@ -15,17 +16,39 @@ COPY . /tmp/tensors
 RUN pip install /tmp/tensors'[server]' && \
     rm -rf /tmp/tensors
 
-# Configure tensors for ComfyUI paths
+# Configure tensors
 RUN mkdir -p /root/.config/tensors && \
-    echo '[paths]' > /root/.config/tensors/config.toml && \
-    echo 'models_dir = "/workspace/ComfyUI/models"' >> /root/.config/tensors/config.toml && \
-    echo 'checkpoints = "/workspace/ComfyUI/models/checkpoints"' >> /root/.config/tensors/config.toml && \
-    echo 'loras = "/workspace/ComfyUI/models/loras"' >> /root/.config/tensors/config.toml && \
-    echo 'vae = "/workspace/ComfyUI/models/vae"' >> /root/.config/tensors/config.toml && \
-    echo 'embeddings = "/workspace/ComfyUI/models/embeddings"' >> /root/.config/tensors/config.toml
+    cat > /root/.config/tensors/config.toml << 'EOF'
+[paths]
+models_dir = "/workspace/ComfyUI/models"
+checkpoints = "/workspace/ComfyUI/models/checkpoints"
+loras = "/workspace/ComfyUI/models/loras"
+vae = "/workspace/ComfyUI/models/vae"
+embeddings = "/workspace/ComfyUI/models/embeddings"
 
-# Expose ports: ComfyUI (8188), tensors API (8080)
-EXPOSE 8188 8080
+[comfyui]
+url = "http://127.0.0.1:8188"
+EOF
 
-# Default: start ComfyUI (override with docker run command for tensors serve)
-CMD ["python", "/workspace/ComfyUI/main.py", "--listen", "0.0.0.0", "--port", "8188"]
+# Startup script: ComfyUI internal + tensors API exposed
+RUN cat > /workspace/start.sh << 'EOF'
+#!/bin/bash
+# Start ComfyUI in background (internal only, localhost)
+python /workspace/ComfyUI/main.py --listen 127.0.0.1 --port 8188 &
+
+# Wait for ComfyUI to be ready
+echo "Waiting for ComfyUI..."
+until curl -s http://127.0.0.1:8188/system_stats > /dev/null 2>&1; do
+    sleep 1
+done
+echo "ComfyUI ready"
+
+# Start tensors API (exposed)
+exec tsr serve --host 0.0.0.0 --port 8080
+EOF
+RUN chmod +x /workspace/start.sh
+
+# Only expose tensors API
+EXPOSE 8080
+
+CMD ["/workspace/start.sh"]