D2 vs Kroki

D2

A single local command turns text into a diagram in six formats with no account, key or network call, and CI passes on the default branch. The language is at 0.9.0 with no stable release, its company sponsor has shut down, and one maintainer with limited time wrote every commit since July.

Kroki

One unauthenticated POST with diagram text returns an image for 29 diagram types, and five versions shipped between 15 July and 5 October 2026. Four advisories were published in July and August 2026, one an unauthenticated remote code execution on /tikz/svg, all fixed. No OpenAPI file exists, and the public instance has no terms, privacy policy or status page.

D2

1. Check the exit status of d2, never the output file. The man page says a partial render can be written when an error occurs
2. Run d2 validate file.d2 before rendering, and d2 fmt to normalise the source
3. Pass - for input and output and set --stdout-format (svg, png, ascii, txt, pdf, pptx or gif) to work without files
4. Use --stdout-format ascii when the reader is a text-only model
5. Pass --bundle=false or review image URLs and imports before rendering D2 text from an untrusted source. Release 0.9.0 fetches remote images when bundling

Kroki

1. Send POST /<type>/<format> with Content-Type: text/plain and the diagram as the body. This avoids the deflate and base64 encoding that GET needs
2. Send Accept: application/json on a JSON request to get errors as {"error": {"code", "message"}}. With an SVG Accept header the error arrives as an image
3. Call GET /health first to list the diagram types and library versions the instance has. Mermaid, BPMN, Excalidraw and diagrams.net need companion containers
4. Run 0.32.1 or later before rendering untrusted text. Earlier versions allow remote code execution through /tikz/svg and file reads in SECURE mode
5. Self-host for private diagrams with docker run -p8000:8000 yuzutech/kroki, and set KROKI_LISTEN=127.0.0.1:8000 or a network rule, since the server has no authentication